Detonation LabsBehavioral security for the AI agent supply chain

SubmitDetonate a package

Run it in the sandbox before it runs on your machine.

Paste a repository, an npm, PyPI or ClawHub name (even a whole openclaw skills install command), or upload a zip. We run it through every detonation condition and publish the report.

A skill (folder with SKILL.md) or an MCP server. For a folder inside a repo, use its /tree/<branch>/<path> URL.

Try

Check your whole MCP configPaste a client config and every server in it is detonated.

Paste claude_desktop_config.json, .cursor/mcp.json, .mcp.json or VS Code's mcp.json. Every server it launches with npx or uvx is detonated. Only package names are read: API keys and other env values are ignored and never stored.

Observed behavior only. A clean result does not prove a package is safe.