Gomcp Worker — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Gomcp Worker (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Cloudflare Workers 版本的 gomcp(Lightpanda Browser 的 MCP Server)。这次总算把最致命的坑补上了,不再是那种“接口能回 200,但灵魂已经离职”的半成品。
2025-03-26initialize 分配会话,后续请求强制复用 Mcp-Session-Id404)Target.createTarget + Target.attachToTargetresources/list / prompts/list 空响应兼容notifications/cancelled 使用正确的 requestIdresult.isError 返回GET /mcp / GET /sse| 工具 | 描述 | 必需参数 |
|---|---|---|
goto | 导航到指定 URL | url |
search | 使用 DuckDuckGo 搜索 | text |
markdown | 获取当前页面 Markdown | — |
links | 提取当前页面链接 | — |
npm installwrangler secret set CDP_URL示例值:
wss://your-lightpanda-instance:9222CDP_URL 应指向 浏览器根 WebSocket。Worker 会在连上后自动创建 target 并 attach,不需要你手搓 page session。npm run devnpm run deploy注意:wrangler.toml已包含MCPSession的 Durable Object migration。后续如重命名 Durable Object 类,必须继续追加 migration,而不是修改已有 tag。
{
"mcpServers": {
"lightpanda": {
"url": "https://your-worker.workers.dev/mcp"
}
}
}Mcp-Session-Idcurl -i -X POST https://your-worker.workers.dev/mcp \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","method":"initialize","params":{},"id":1}'Mcp-Session-Id 调用后续方法curl -X POST https://your-worker.workers.dev/mcp \
-H "Content-Type: application/json" \
-H "Mcp-Session-Id: <session-id-from-initialize>" \
-d '{"jsonrpc":"2.0","method":"tools/list","params":{},"id":2}'initialize 会返回新的 Mcp-Session-Id;后续 tools/list / ping / tools/call / GET /mcp / DELETE /mcp 都必须带上它。GET /mcp 和 GET /sse 是轻量 SSE 握手入口,不负责旧版 /messages 传输。initialize / tools/list / ping / resources/list / prompts/list 不依赖 CDP;只有 tools/call 需要连接浏览器。resources/list 和 prompts/list 当前返回空数组,这是故意的,不是服务器在摆烂——虽然看起来很像。Apache-2.0
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.