llms.txt
+17 −2
https://mcpcanary.com/llms.txt
− 1. `canary inspect <url> --json` lists tools with `side_effects`: `read_only`, `possibly_mutating`, `explicitly_mutating`, `unknown`. It never calls a tool.− canary inspect URL+ 1. `canary inspect <url> --json` lists tools with `side_effects`: `read_only`, `possibly_mutating`, `explicitly_mutating`, `unknown`. It never calls a tool. `agent_readiness` grades the server (A-F) and lists findings (`rule`, `severity`, `tool`, `message`, `fix`, `example`); if you own the server code, apply the fixes.+ - First check `TARGET_AUTH_FAILED` and the server uses OAuth: `canary auth login <name> --json` returns `authorize_url`. Give it to the human (never open it yourself), then poll `canary auth status <name> --json` until `login_pending` is false and `status` is `active`. A server without self-registration (GitHub) needs the human's OAuth app: `--client-id ID --client-secret-env VAR`. `TARGET_AUTH_EXPIRED` later = ask the human to sign in again.+ ## WebMCP websites (Shopify stores and other web pages)+ WebMCP tools live in a web page, not on an MCP server: the page registers them with `document.modelContext.registerTool()`. Every Shopify Liquid store has them (`search_catalog`, `get_product`, `get_cart`, `add_to_cart`, ...). Use `--website <page-url>` instead of `--url`; everything else is the same.+ - `canary inspect --website <page-url> --json` opens the page in a browser and lists its tools (`transport: "webmcp"`, no protocol). It never calls a tool.+ - `canary monitor set <name> --website <page-url> --tool search_catalog --args '{"catalog":{"query":"<a product that always exists>"}}' --assert '$.products[0].available == true' --dry-run`+ - Read-only tools (`readOnlyHint: true`) run without `--allow-side-effects`. Tools that move the page (`get_product`, `browse_store`, `show_variant`) are not read-only. Each check uses a new, empty browser session, so a cart tool never touches a real shopper's cart.+ - No `--bearer-env`, `--header-env`, or `canary auth login` with `--website`: the browser would send secrets to every script of the page.+ - Failure codes: `WEBMCP_NO_TOOLS` (the page registered no tools), `TARGET_BLOCKED_BY_WAF` (401, 403, or 429), `TARGET_UNAVAILABLE`, `TARGET_TIMEOUT`.+ - Checkout tools appear only after `proceed_to_checkout` with a full cart; a monitor cannot test them.+ canary inspect URL | canary inspect --website PAGE_URL+ canary workspace show (workspace id, API URL, token source; never the token)+ - Browser MCP server tester (is it up): https://mcpcanary.com/check/?url=URL+ - Browser MCP server validator (grade and fixes, same as `canary inspect`): https://mcpcanary.com/validator/?url=URL+ - WebMCP on Shopify (overview): https://mcpcanary.com/webmcp/+ - Browser WebMCP checker (Shopify stores, any web page): https://mcpcanary.com/webmcp/check/?website=URL+ - Browser WebMCP validator (grade and fixes, same as `canary inspect --website`): https://mcpcanary.com/webmcp/validator/?website=URL