Category comparison
Local vs hosted MCP manifest analysis
Compare in-browser and server-upload MCP manifest inspection across privacy, reproducibility, policy, scale, and operational tradeoffs.
- Published
- Reading time
- 6 minutes
Local analysis minimizes a new disclosure
MCP client configurations may contain environment values, internal endpoints, package names, filesystem paths, and operational descriptions. In-browser analysis can inspect the pasted text without sending that content to another analysis server.
Local processing does not make the input harmless. The page must avoid executing embedded commands, following URLs, evaluating code, or persisting pasted content. Users should still redact live credentials when practical.
Hosted systems can centralize policy
A hosted service can support organization-wide retention, shared findings, heavy computation, and centralized rule updates. It also becomes another recipient of sensitive configuration and requires controls for transport, storage, access, deletion, tenancy, and incident response.
The right choice depends on policy and evidence needs. Ask whether raw manifests leave the device, which metadata is logged, how long content remains, and whether administrators can inspect it.
Separate content from anonymous metrics
A local-first tool can count bounded finding codes without collecting pasted content, provided telemetry is designed and documented that way. Review the implementation rather than relying on a privacy label.
tryb performs manifest analysis in the browser and does not send pasted content for analysis. Its static rules are intentionally bounded, so privacy should not be confused with complete security coverage.
Frequently asked questions
Does tryb upload my MCP manifest?
No. Pasted content is processed locally in the browser. Anonymous finding codes may be counted, but pasted content is not included.
Is hosted analysis always unsafe?
No. It can be appropriate with suitable contractual and technical controls. It introduces a data recipient that must be evaluated.