Find an app
Account
Toggle menu

Use in your browser

Find vulnerable JavaScript

Scan any public page for JavaScript libraries with known published vulnerabilities. One Retire.js pass matches the external scripts in the served HTML against the public vulnerability database.

Guest includes 50 lifetime app requests. Create a free account for 100 app requests each calendar month. One allowance across every app, in your browser and your agent.One allowance across every app, in your browser and your agent. Manage usage

JS Vulnerability Check

Connect agent

Guest access is available after setup. Full account linking verified by PowMCP: Claude only.

JS scan

Scan the external scripts present in a page's served HTML for library versions with known published vulnerabilities.

Usually finishes in a few seconds; a page with many large scripts can take up to two minutes.

Add JS Vulnerability Check to your agent

Connect this app on its own. Add other PowMCP apps whenever your agent needs another job done.

Open the apps workspace A glowing app tile clicking into a slot on a dark agent device, with the PowMCP app box behind it

Connect directly

Choose your agent. Each button opens a new tab with only this app's endpoint ready to add.

Use another agent

Copy one ready-to-send prompt for any agent that supports remote MCP connections.

Manual endpoint, JSON, and terminal commands

For clients that require manual configuration, use this app-only endpoint, its JSON entry, or one terminal command.

ChatGPT: enable Developer mode in Settings → Security and login, then add this MCP endpoint from the Plugins page. Availability depends on your account and workspace policy. PowMCP has not yet verified ChatGPT account linking. OpenAI setup guide

https://powmcp.com/js-vulnerability-check/mcp
{
  "mcpServers": {
    "powmcp-js-vulnerability-check": {
      "type": "http",
      "url": "https://powmcp.com/js-vulnerability-check/mcp"
    }
  }
}

Terminal agents add this app with one command:

Claude Code
claude mcp add --transport http powmcp-js-vulnerability-check https://powmcp.com/js-vulnerability-check/mcp
Codex CLI
codex mcp add powmcp-js-vulnerability-check --url https://powmcp.com/js-vulnerability-check/mcp
Gemini CLI
gemini mcp add --transport http powmcp-js-vulnerability-check https://powmcp.com/js-vulnerability-check/mcp

Manage, disable, or remove this connection in your agent's own MCP settings. PowMCP does not label an external connection as installed without confirmation from that client.

Proof

What it does

A Retire.js scan of the external scripts present in a page's served HTML, matched against the public database of known JavaScript library vulnerabilities

Find out whether a public web page is serving JavaScript libraries with publicly known vulnerabilities, straight from the conversation. The check fetches the page, downloads the external scripts present in the served HTML and matches them against the Retire.js public vulnerability database, then reports how many scripts were actually scanned and which library versions carry published vulnerabilities, with severity counts: no browser is launched, so scripts added at runtime by other scripts, module imports, or a tag manager are not observed; scoped to what a Retire.js scan can establish, never dressed up as a general security audit.

Category
Developer Tools

Request cost1 completed result

Guests get 50 lifetime app requests. Free accounts get 100 each calendar month.

Tools in this app

01

JS Vulnerability Check

js_vulnerability_check

Scans one public web page for JavaScript libraries with publicly known vulnerabilities: fetches the page, downloads the external scripts present in the served HTML and matches them against the Retire.js public vulnerability database. Returns how many scripts were actually scanned plus each vulnerable library with its detected version, published vulnerability count and worst severity. No browser is launched, so scripts added at runtime by other scripts, module imports, or a tag manager are not observed. Reach for it for outdated-JavaScript, old-jQuery and dependency-vulnerability questions about a live page. Typically 1-5 seconds.

JS Vulnerability Check questions

Scope and boundaries for JS Vulnerability Check.

01What can I check with JS Vulnerability Check?

Scan https://www.wikipedia.org, or another public page suspected of serving an old jQuery or React build, to match the external script files named in its served HTML against the Retire.js vulnerability database.

02How should I read the result?

Read scannedScripts first: zero means no vulnerability verdict because no external script from the served HTML was scanned. If vulnerable libraries are listed, upgrade the flagged versions and rerun; if a positive script count has no matches, Retire.js found no published vulnerability only in the library versions it recognized. Runtime-injected scripts, module imports, inline or first-party flaws, and server security remain untested.

03What are its limits?

No browser is launched: runtime-injected scripts, module imports, tag-manager additions, inline code, first-party application flaws, and server vulnerabilities are not observed. A clean match means only that Retire.js found no published vulnerability for the external library versions it recognized; this is not a general security audit.