Getting started
Pick a Tamperbox surface, run a small example, and keep the result's warnings and limits intact.
Pick a surface
Section titled “Pick a surface”| Need | Use |
|---|---|
| Explore a tool visually | tamperbox.dev, with the method behind each finding under Tool pages |
| Call one documented endpoint | Tamperbox REST API |
| Let an agent discover and combine operations | Tamperbox MCP |
Run the MCP server locally
Section titled “Run the MCP server locally”The released package starts a stdio server and uses the production Tamperbox API by default.
npx -y tamperbox-mcp@0.2.0Most clients need the command split into an executable and arguments. Start with npx, then pass -y and tamperbox-mcp@0.2.0 as arguments.
Try a safe first task
Section titled “Try a safe first task”Ask the connected client:
Show me the input and output schemas for
json_format. Do not run it yet.
The agent should use search, return a focused schema fragment, and report apiCalls: 0. Next, give it synthetic JSON and ask it to format the value. That second task should use execute.
Verify the boundary
Section titled “Verify the boundary”search reads the bundled OpenAPI snapshot and makes no API request. execute can call allowlisted Tamperbox API routes. Inputs embedded in executed code are visible to the MCP host, the API for each request, and the model provider carrying the tool call.
Continue with Connect a client or Code mode.