Check an MCP config or a shell command

How it works

• A config is read as deedglass scan reads it in a folder that holds only that file: the servers, their packages, the tools they give the agent and whether each write goes through a check. The grade formula is the same.
• A command is split the way the shell guard splits it (pipes, &&, sh -c, heredocs) and compared with its dated, sourced catalog. No file is read.
• No database is checked here. Run npx deedglass scan --postgres-dsn-env DATABASE_URL on your machine to include the database role and tables.

Questions

Is my config uploaded?

No. The scan runs in your browser, as WebAssembly fetched from this site when you first press Check. The page sends nothing you paste anywhere, and the share link keeps your input after the # sign, which browsers never send to a server.

Is this the same check as the CLI?

Yes. It is deedglass 0.15.0's own scan and shell-guard code compiled to WebAssembly. A config gets the grade deedglass scan gives a folder holding only that file; a command gets the answer deedglass guard shell --no-files --command gives.

Why does a command get no grade?

The grade measures a setup: what the agents configured on a machine could change. A single command gets the shell guard’s answer instead: it asks first, or it has nothing to ask about.

Why is rm -rf not caught?

The 0.15.0 shell guard’s catalog covers commands that destroy database data or cloud resources, such as prisma migrate reset, dropdb, SQL with DROP or TRUNCATE, terraform destroy and railway volume delete. Commands outside it, such as rm -rf or railway down, get no question from the guard, and your agent’s own permission settings decide.