From e180494a7a328082021e3314e48c580dba28493a Mon Sep 17 00:00:00 2001
From: Name? <113548499+ElonMusk2002@users.noreply.github.com>
Date: Sat, 15 Aug 2026 12:07:16 -0700
Subject: [PATCH] Add WebMCP Attack Surface Scanner to README

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index aee2a8c..230f032 100644
--- a/README.md
+++ b/README.md
@@ -68,6 +68,7 @@
 - [Conscriba](https://conscriba.com/) — Automatic WebMCP Creation for AI Agents, Analytics & Tracking
 - [WSG WebMCP Experiment](https://mgifford.github.io/wsg-webmcp-experiment/) - An effort to learn about WebMCP by applying it to the [Web Sustainability Guidelines](https://github.com/w3c/sustainableweb-wsg)
 - [webmcpify](https://github.com/TueJon/webmcpify) - Agent skill that integrates WebMCP into an existing web app end to end — inventories the app, proposes a tool manifest for approval, integrates the tools, then verifies each one in a real browser and heals failures
+- [WebMCP Attack Surface Scanner](https://github.com/ElonMusk2002/webmcp-scanner) - Chrome extension that discovers a page's WebMCP tools and flags IDOR, prompt injection hidden in tool descriptions, destructive actions without a consent gate, and over-broad input schemas — includes active IDOR probing (real tool calls with varied IDs, not just name-based heuristics)
 
 ## Tutorials