Store Canary

Check what a store exposes publicly

check_exposure

Read-onlyIdempotent

Flag WordPress, WooCommerce, plugin and PHP versions a store shows publicly (generator tags, asset ?ver= values, X-Powered-By), a public /readme.html and a readable /wp-content/debug.log. Log contents are never returned or kept. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved; ongoing checks are Store Canary Pro. A bare hostname is fine; URL paths are ignored and the host's homepage is checked.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "url": "<url>"
    },
    "name": "check_exposure"
  }
}

Input Schema

Name	Required	Description	Default
`url`	Yes	The store's public address, for example https://example.com. A bare hostname (example.com) is fine. Any path, query or fragment is ignored: the homepage of the host is checked.

Output Schema

Name	Required	Description
`url`	Yes	Normalized store origin that was checked.
`status`	Yes	checked = findings below; otherwise no store request was made.
`liteUrl`	Yes	Store Canary Lite on WordPress.org (free).
`overall`	Yes
`summary`	Yes
`auditUrl`	Yes	Full Store Canary audit (plain external link).
`findings`	Yes
`checkedAt`	Yes
`reportUrl`	No	Shareable read-only report page. The result is encoded in the link; nothing is stored.
`proTrialUrl`	Yes	Store Canary Pro 30-day free trial.

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedOct 31, 2026

changedInput schema / properties / url / description

Previous value: -"The store's public address, for example https://example.com"New value: +"The store's public address, for example https://example.com. A bare hostname (example.com) is fine. Any path, query or fragment is ignored: the homepage of the host is checked."

Changed1 schema field changedOct 30, 2026

addedOutput schema / properties / reportUrl

Added value: +{
+  "description": "Shareable read-only report page. The result is encoded in the link; nothing is stored.",
+  "format": "uri",
+  "type": "string"
+}

AddedOct 30, 2026

TDQS

A4.1/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: it specifies the exact HTTP evidence collected, states that debug.log contents are never returned or kept, and confirms nothing is monitored or saved. Those privacy and non-persistence guarantees are exactly the behavioral context an agent cannot infer from readOnlyHint/idempotentHint alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with what is detected, then constraints and scope, in four dense sentences with little filler. The last sentence is largely redundant with the schema's url description, costing a point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter, read-only scanner with an output schema (so return values need no explanation), the description covers detection targets, side effects, data retention and URL handling. Nothing an agent needs to call it safely is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the url property description already says a bare hostname is fine and paths/queries/fragments are ignored. The description's final sentence repeats that verbatim rather than adding new semantics (e.g., what happens on unreachable hosts or redirects), so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Uses a specific verb ('Flag') with a precise, enumerated resource: exposed WordPress/WooCommerce/plugin/PHP versions via generator tags, ?ver= assets, X-Powered-By, /readme.html and /wp-content/debug.log. That scope is narrow enough to be visually distinct from check_ssl, check_speed or check_seo_basics, but it never names or contrasts any sibling, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear operating context: one run of GET requests, read-only, no login/cart/form submission, and it redirects 'ongoing checks' to Store Canary Pro. It does not tell the agent when to prefer check_store or check_ssl over this tool, which is the missing piece for a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Store Canary tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.