webspector

Plugin webspector from marketplace webspec-local in I-m-A-g-I-n-E/WebSpec. Commands read from the repo's manifest — 19 days ago.

Skills (5)

• Authentication & Authorization

  This skill should be used when checking WebSpec security levels 0 to 4 and the code that meets them - the guard (WebSpec-Nonce, WebSpec-Guard HMAC), Idempotency-Key and replays, the level-3 clearance (WebSpec-Clearance), level-4 human approval (428 challenge, WebSpec-Approval, webspec-ctl approve),

• HTTP Methods

  This skill should be used when checking WebSpec tool contracts and method binding - MCP tool annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint), which HTTP methods may invoke a tool, the WebSpec-Definer header and its verb families, what each request must carry by level, and

• Service Discovery

  This skill should be used when checking how WebSpec clients discover a destination's tools and route map - GET / (tools and their entries), OPTIONS / and OPTIONS /{noun} (per-method entries with inputSchema, contract, and requirements), HEAD / and HEAD /{noun} (health, Allow, Link), the reserved pat

• Subdomain Architecture

  This skill should be used when checking how WebSpec destinations map to hosts and origins - the destination label, qualifier labels, loopback names versus a public domain, per-destination state, the proxy in front of the gateway, and CORS (WEBSPEC_CORS_ORIGINS, preflights, the headers an allowed ori

• URL Grammar

  This skill should be used when checking how WebSpec requests are addressed - the host (destination, qualifiers, domain), the route rule that gives each MCP tool a method and a single-segment noun path, the route map (collisions, binding pins, Allow), and where arguments go (query or JSON body). Trig

Slash commands (2)

• /webspector:check

  Quick check of a specific WebSpec standard area

• /webspector:validate

  Run a full WebSpec compliance check on the current codebase

Subagents (5)

• auth-flow-auditor

  Proactive WebSpec security-level auditor. Checks the code that meets levels 1 to 4: nonce fetching and the WebSpec-Guard HMAC, Idempotency-Key use and retries, the WebSpec-Clearance token, the level-4 approval flow (428 challenge, WebSpec-Approval retry), and custody of the guard key in the harness

• http-methods-reviewer

  Proactive WebSpec methods reviewer. Checks MCP tool annotations against what the tools do, the method each request uses against the tool's contract (method binding), the WebSpec-Definer header (required on POST, optional and family-checked on PUT, PATCH, DELETE), and how clients handle WebSpec respo

• service-discovery-reviewer

  Proactive WebSpec discovery reviewer. Checks that clients learn a destination's route map from GET /, OPTIONS /, or OPTIONS /{noun} instead of guessing paths, use each entry's requirements and tool, handle closed entries, and use HEAD only as a route check; and that gateways answer discovery without

• subdomain-security-analyzer

  Proactive WebSpec destination and origin analyzer. Checks that each destination is its own host and origin, that qualifiers only route, that level-0 destinations stay on loopback names, that the proxy forwards only WebSpec hosts with Host preserved, and that CORS is off or limited to trusted origins

• url-grammar-validator

  Proactive WebSpec addressing validator. Checks that code builds WebSpec requests the way the spec addresses them: a lowercase destination host, a single-segment noun path taken from the route map, the method and (on POST) the definer of the tool's entry, and arguments in the query or a JSON body by

Similar plugins