EmbedDoctor
The live contract debugger for embedded apps
Manual preview mode 5 semantic tools
checkout → payment-widget
Late listener, v1 retry, and a same-origin sibling forgery.
report-only
Live checkout
real iframe fixturemerchant.test / checkout
Order total
$120.00
Real postMessage traffic between an adopted widget and a same-origin sibling frame.
Hosttop document
Widgetexpected source
Siblingsame origin · wrong source
Runtime identity
- widget
- origin exact · source expected
- sibling
- origin exact · source mismatch
- session
- rotates each replay
- schedule
- seed 4729
Boundary sequence
ready to captureHost
Payment widget
Sibling frame
No boundary traffic yet
Capture message order, actual origin, source identity, and the rendered result.
Contract inspector
awaiting evidenceBoundary health
—checks passed
Evidence comes first
Findings and scores are derived only after a browser run completes.
Human control: the agent may inspect, stage, replay, undo, and prepare export. Approval is absent from the WebMCP surface.
Widget state: waiting. Capture a run to give the agent browser evidence.