{
  "$schema": "https://registry.modelcontextprotocol.io/schemas/server.json",
  "name": "dev.walkaround/walkaround",
  "title": "Walkaround Launch Check",
  "description": "Twelve deterministic checks on whether a web app can be opened to strangers, as a dated receipt. Free to scan; the unsealed report (evidence, fixes, and a security model's own read of the app) is paid for. Read-only: public pages only, no account creation, no login unless a customer created and opted in a test account, no id probing.",
  "version": "1.0.0",
  "websiteUrl": "https://staging.walkaround.dev/",
  "icons": [
    {
      "src": "https://staging.walkaround.dev/favicon.svg",
      "mimeType": "image/svg+xml"
    }
  ],
  "license": "proprietary",
  "repository": {
    "type": "git",
    "url": "https://walkaround.dev/"
  },
  "remotes": [
    {
      "type": "streamable-http",
      "url": "https://staging.walkaround.dev/mcp",
      "supportedProtocolVersions": [
        "2025-06-18",
        "2025-03-26",
        "2024-11-05"
      ]
    }
  ],
  "protocolVersion": "2025-06-18",
  "domainVerification": {
    "domain": "walkaround.dev",
    "method": "dns-txt",
    "record": {
      "type": "TXT",
      "name": "_mcp.walkaround.dev",
      "value": "mcp-verify=8f2c41d0a7b34e5c9d16af83e0572b4c"
    },
    "well_known_url": "https://walkaround.dev/.well-known/mcp-verification.txt",
    "note": "Published by the owner in DNS. Nothing in this repository submits the server to the registry, and the token is public by design."
  },
  "capabilities": {
    "tools": {
      "listChanged": false
    },
    "resources": {},
    "logging": {}
  },
  "tools": [
    {
      "name": "scan_app",
      "title": "Check a web app before shipping it",
      "description": "Run twelve deterministic checks against the outside of a public web app and return a dated verdict: the stamp, the open/closed/not-checked counts, every line with its plain-English consequence, what was skipped, and the receipt id and URL. Free, no token. It reads public pages only: it does not sign in, does not create an account and does not guess anything. A clean verdict is not a guarantee of safety.",
      "inputSchema": {
        "type": "object",
        "required": [
          "url"
        ],
        "properties": {
          "url": {
            "type": "string",
            "description": "The app to check, e.g. https://example.com"
          }
        }
      }
    },
    {
      "name": "get_receipt",
      "title": "Read a receipt, and unseal it if there is credit",
      "description": "Read a receipt back as JSON by its id. Folded, it returns the twelve lines and a pay object naming where a human pays. With a bearer token that has credit it unseals: the evidence and the fix paragraph for every open line, and the SOTA Security Model read of the app. One fixed price per unsealed report. 401 for a token we did not issue, 402 when the balance will not cover it.",
      "inputSchema": {
        "type": "object",
        "required": [
          "receipt_id"
        ],
        "properties": {
          "receipt_id": {
            "type": "string",
            "description": "The receipt id, from scan_app."
          },
          "token": {
            "type": "string",
            "description": "Optional API credit token. Without it the receipt comes back folded."
          }
        }
      }
    }
  ],
  "payment": {
    "model": "prepaid API credit, bought by a human, spent by the agent",
    "price_per_unsealed_report": "£0.25",
    "credit_block": "£10.00",
    "human_top_up_url": "https://staging.walkaround.dev/api-credit",
    "free": "POST https://staging.walkaround.dev/api/v1/scans needs no token and no account",
    "note": "No crypto, no card held by an agent: a bearer token from the balance."
  },
  "documentation": {
    "llms_txt": "https://staging.walkaround.dev/llms.txt",
    "openapi": "https://staging.walkaround.dev/openapi.json",
    "api_version": "v1"
  },
  "limitations": [
    "Reads public pages and public form fields only, with made-up data.",
    "Never creates an account on a customer app.",
    "Signs in only with an account the customer created and opted in.",
    "Never probes identifiers, and never guesses a password.",
    "The model read is paid-only, and its findings never decide the verdict."
  ]
}