Walkthrough Mcp Tool — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Walkthrough Mcp Tool (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An agentic MCP server that reads your app's source code, generates contextually valid dummy data, and drives a browser through your pages — narrating every step.
Developer runs agent
↓
Agent reads source folder → understands page structure
↓
Gemini generates contextually valid dummy inputs
↓
Playwright opens localhost URL + fills inputs + navigates
↓
On validation error → extract error from DOM → Gemini corrects inputs → retry (up to 3x)
↓
Output: terminal narration + screenshots + markdown report + Playwright tracegit clone <this repo>
cd walkthrough-agent
npm install
npx playwright install chromium
cp .env.example .env
# Add your GEMINI_API_KEY to .envGet a free Gemini API key at aistudio.google.com.
# Analyze + generate inputs + run browser walkthrough
npx walkthrough-agent --url http://localhost:3000/signup --folder ./src/app/signup
# DOM-only mode (no source folder needed)
npx walkthrough-agent --url http://localhost:3000/login
# Analyze only — print PageAnalysis + InputMap, no browser
npx walkthrough-agent --url http://localhost:3000/signup --folder ./src --analyze-only
# Override entry file detection
npx walkthrough-agent --url http://localhost:3000 --folder ./src --entry App.tsx
# Adjust max retries
npx walkthrough-agent --url http://localhost:3000/signup --folder ./src --retries 5Each run creates a timestamped directory:
output/run-2026-01-15-143022/
report.md ← walkthrough narrative
trace.zip ← Playwright trace (open at trace.playwright.dev)
screenshots/
01-page-load.png
02-fill-email.png
03-submit.png
04-result.pngnpm run build{
"mcpServers": {
"walkthrough-agent": {
"command": "node",
"args": ["/path/to/walkthrough-agent/dist/server.js"],
"env": { "GEMINI_API_KEY": "your-key-here" }
}
}
}analyze_page — extract form structure from source + live DOMgenerate_inputs — generate valid dummy datarun_walkthrough — drive Playwright through the pagegenerate_report — write markdown reportWalkthrough Agent
──────────────────────────────────────────────────
Analyzing ./src/app/signup ...
Entry file: page.tsx
Found: email, password, confirm-password, submit
Validation rules: valid email, min 8 chars, must match password
Generating inputs...
email → [email protected]
password → Walkthrough#42
confirm-password → Walkthrough#42
Output directory: output/run-2026-01-15-143022
Opening http://localhost:3000/signup
Page loaded
email filled
password filled
confirm-password filled
Submitting...
Error detected: "Password must contain a special character"
Retry 1/3 — correcting inputs...
Submission successful
──────────────────────────────────────────────────
Screenshot(s) saved: 6 files in output/run-.../screenshots
Report saved: output/run-.../report.md
Trace saved: output/run-.../trace.zipSee PLAN.md for items to address before implementation:
analyze_page Playwright lifecycle in DOM-only modesrc/tools/report.ts--session-cookie flag)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.