Introduction - Test WebMCP

The Test WebMCP API does everything the website does: start a scan, get the report, and read the leaderboard.

https://testwebmcp.com/api/v1

There’s no sign-up and no key. Requests are limited per IP address. Every endpoint in the API reference has a panel for sending real requests from your browser. Starting a scan there uses your daily scan, the same as the website.

Quickstart

Start a scan:

curl -X POST https://testwebmcp.com/api/v1/scan \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com"}'

{
  "id": "cmueqnsac0002ig6dt23byquq",
  "status": "queued",
  "url": "https://example.com/",
  "statusUrl": "https://testwebmcp.com/api/v1/scan/cmueqnsac0002ig6dt23byquq",
  "reportUrl": "https://testwebmcp.com/scan/cmueqnsac0002ig6dt23byquq"
}

Poll statusUrl every few seconds. A scan takes up to a minute. It returns 202 while the scan runs and 200 when it’s done:

curl https://testwebmcp.com/api/v1/scan/cmueqnsac0002ig6dt23byquq

{
  "id": "cmueqnsac0002ig6dt23byquq",
  "status": "succeeded",
  "score": 72,
  "grade": "C",
  "report": { "summary": "3 tool(s) registered. 2 returned results when called.", "...": "..." }
}

reportUrl is the same report on the website, for sharing.

In code

async function scan(url) {
  const res = await fetch("https://testwebmcp.com/api/v1/scan", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ url }),
  });
  const started = await res.json();
  if (!res.ok) throw new Error(started.error);

  while (true) {
    await new Promise((r) => setTimeout(r, 3000));
    const poll = await fetch(started.statusUrl);
    if (poll.status !== 202) return poll.json();
  }
}