DECLARE YOUR ITEMS — tools/list JSON
stays local
checkpoint opening…
REMOTE SCREENING — live server, best-effort CORS
Browser → server, streamable-HTTP only. Works when the server sends CORS headers; most don't — paste mode is the reliable path. The token is kept in memory and sent only to the URL you type.
NOTICE OF INSPECTION
Nothing on the belt yet.
Load the poisoned example to watch the detectors fire — injected instructions, concealed content, solicited secrets, and friends.