Walkaround

dev.walkaroundPublished by walkaround.devOfficial publisherv1.0.0Updated Oct 26, 2026

Launch check for AI-built apps: SAFE or DO NOT SHIP verdict, with evidence and paste-back fixes.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Runs twelve deterministic outside-in checks on a public web app and returns a dated SAFE or DO NOT SHIP launch verdict, with optional paid evidence and fixes.

What you can do
  • Scan a public web app with twelve deterministic checks and get a dated verdict with open, closed and not-checked counts
  • Read each line's plain-English consequence, what was skipped, and the receipt id and URL
  • Fetch a receipt back as JSON by its id, including a pay object naming where a human pays
  • Unseal a receipt with a bearer token that has credit to get evidence and a fix paragraph for every open line, plus a security model read of the app
When to use it
Useful before shipping an AI-built or small web app, when you want a quick, repeatable outside-in check of public pages and a clear ship or do-not-ship call rather than a full penetration test.
Requirements
Remote streamable HTTP endpoint at walkaround.dev; no package, environment variable or header is declared. Scanning is free and needs no token. Unsealing a receipt requires a bearer token that holds credit.
Before you install
Unsealing receipts is paid at a fixed price per unsealed receipt, so a bearer token with credit can spend money. The scan only reads public pages and does not sign in or test authenticated areas, so a SAFE verdict is limited to what was checked.

Installation

In SourceWeft

  1. Open Walkaround in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/dev.walkaround%2Fwalkaround/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "walkaround": {
      "type": "http",
      "url": "https://walkaround.dev/mcp"
    }
  }
}

Tools

2

scan_app

Check a web app before shipping it

Run twelve deterministic checks against the outside of a public web app and return a dated verdict: the stamp, the open/closed/not-checked counts, every line with its plain-English consequence, what was skipped, and the receipt id and URL. Free, no token. It reads public pages only: it does not sign in, does not create an account and does not guess anything. A clean verdict is not a guarantee of safety.

Parametersurlrequired

get_receipt

Read a receipt, and unseal it if there is credit

Read a receipt back as JSON by its id. Folded, it returns the twelve lines and a pay object naming where a human pays. With a bearer token that has credit it unseals: the evidence and the fix paragraph for every open line, and the SOTA Security Model read of the app. One fixed price per unsealed report. 401 for a token we did not issue, 402 when the balance will not cover it.

Parameterstokenreceipt_idrequired

Version history

1
  1. v1.0.0LatestOct 20, 2026

Score

72% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts

    Publish an icon in the registry entry.

  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.