{ "query": "", "kind": "webmcp", "page": 1, "pages": 1, "pageSize": 24, "total": 22, "results": [ { "kind": "webmcp", "slug": "webmcpify", "name": "webmcpify", "vendor": "TueJon", "description": "webmcpify is an agent skill that takes an existing web application, inventories what it does, proposes a WebMCP tool surface for it, then implements and verifies those tools. It is a code-generation workflow rather than a runtime component: you point an agent at your app and it writes the registrations.\n\nThe capability profile follows from that. It reads and writes files in the repository it is applied to, runs commands to verify its work, and reaches the network for model calls — the combination Anomity flags as a full-control pattern, which is normal for any coding agent skill and is why it belongs behind review rather than autopilot. The output deserves a second look too: an agent deciding which of your app's operations should become agent-callable is a security design decision being made by a model.", "website": "https://github.com/tuejon/webmcpify", "repository": "https://github.com/tuejon/webmcpify", "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write", "shell:execute", "network:outbound" ], "packaging": null, "configFiles": null, "category": "agent-skill", "updatedAt": "2026-09-02", "risk": { "score": 100, "band": "critical", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "2 high-risk capabilities: filesystem:write, shell:execute", "contribution": 20 }, { "id": "exfiltration-risk", "kind": "combination", "label": "Data exfiltration risk (high)", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "contribution": 15 }, { "id": "filesystem-write-shell-risk", "kind": "combination", "label": "Persistence + execution risk (medium)", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "contribution": 5 }, { "id": "full-control-risk", "kind": "combination", "label": "Full-control risk (critical)", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "contribution": 25 } ], "dangerousCombos": [ { "id": "exfiltration-risk", "name": "Data exfiltration risk", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "capabilities": [ "shell:execute", "network:outbound" ], "severity": "high" }, { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" }, { "id": "full-control-risk", "name": "Full-control risk", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "capabilities": [ "shell:execute", "filesystem:write", "network:outbound" ], "severity": "critical" } ] }, "dangerousCombos": [ { "id": "exfiltration-risk", "name": "Data exfiltration risk", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "capabilities": [ "shell:execute", "network:outbound" ], "severity": "high" }, { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" }, { "id": "full-control-risk", "name": "Full-control risk", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "capabilities": [ "shell:execute", "filesystem:write", "network:outbound" ], "severity": "critical" } ] }, { "kind": "webmcp", "slug": "latch-webmcp", "name": "Latch", "vendor": "Latch", "description": "Latch is a one-script WebMCP integration for existing sites. Rather than asking developers to hand-author tool definitions, it inspects the page for recognisable search handlers, cart actions, and form submissions and automatically registers matching WebMCP tools. The pitch is agent-readiness without a rewrite.\n\nAutomatic registration is the risk. A hand-written tool surface is a deliberate list of what agents may do; an inferred one is whatever the scanner happened to recognise, which can include destructive form handlers nobody intended to publish. Latch declares browser control and outbound network access. If you deploy it, audit the resulting tool list the way you would audit a newly generated API — with the Inspector or Radar — before assuming the surface matches your intent.", "website": "https://latch.dev", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "browser:control", "network:outbound" ], "packaging": null, "configFiles": null, "category": "integration", "updatedAt": "2026-09-02", "risk": { "score": 40, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "mcp-webcomic-site-server", "name": "MCP Webcomic Site Server", "vendor": "Nearest Nabors", "description": "A tutorial template that ships an 11ty archive website together with an MCP server and in-browser tools, showing how a content site can serve both human readers and agents from one codebase.\n\nIt is catalogued as the smallest complete example of the hybrid pattern — server-side MCP plus page-level WebMCP — which is where most publishers will end up. Its declared capabilities are filesystem reads for the site content and outbound network access. As a template rather than a hosted service, the risk transfers to whoever deploys it: the generated MCP server inherits whatever filesystem scope it is configured with, and tutorials tend to be copied with their defaults intact.", "website": "https://github.com/nearestnabors", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "network:outbound" ], "packaging": null, "configFiles": null, "category": "template", "updatedAt": "2026-09-02", "risk": { "score": 40, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "model-context-tool-inspector", "name": "Model Context Tool Inspector", "vendor": "Beaufort", "description": "A Chrome extension that discovers the WebMCP tools a page registers, renders their JSON schemas, and lets you invoke them manually with arguments you choose. Where WebMCP Radar answers \"what is here\", the Inspector answers \"what happens when it runs\".\n\nManual invocation is exactly what makes it useful for review and exactly what makes it sharp. Calling a tool from the Inspector executes it in the live page, in the live session — a `checkout` or `deleteAccount` tool does the real thing. It declares browser control and outbound network access. Use it against staging, or against accounts you are willing to mutate, and treat every successful invocation as evidence of what a compromised agent could have done unattended.", "website": "https://chromewebstore.google.com/", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "browser:control", "network:outbound" ], "packaging": null, "configFiles": null, "category": "browser-extension", "updatedAt": "2026-09-02", "risk": { "score": 40, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "nekuda-webmcp-workbench", "name": "nekuda WebMCP Workbench", "vendor": "Nekuda", "description": "A Chrome side-panel workbench for working with WebMCP tools end to end: inspect the tools a page registers, invoke them with structured arguments, test sequences, and audit what was called. It targets developers building agent-native pages who need to see their own tool surface the way an agent sees it.\n\nBecause it both reads and invokes, it inherits the full risk of the page it is pointed at. Its declared capabilities are browser control and outbound network access. The audit trail is the part worth adopting as practice: if you are shipping WebMCP tools, the record of which tools were invoked with which arguments is the difference between debugging an agent's behaviour and guessing at it.", "website": "https://nekuda.ai", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "browser:control", "network:outbound" ], "packaging": null, "configFiles": null, "category": "browser-extension", "updatedAt": "2026-09-02", "risk": { "score": 40, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "stacktree-webmcp", "name": "Stacktree", "vendor": "Stacktree", "description": "Stacktree is a publishing service exposed through WebMCP: an agent hands it generated HTML and receives a shareable, claimable link in return. It turns \"the model made a page\" into \"the page is live at a URL\" in a single tool call.\n\nThat is a genuinely useful primitive and a genuinely sharp one. An agent with access to this tool can publish content to the open web autonomously — content it authored, from context it was given, possibly including material it should not have republished. It declares outbound network access. Anyone enabling it for an agent should think of it as granting publish rights, and should expect to need a review step between generation and publication rather than after it.", "website": "https://stacktree.com", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "network:outbound" ], "packaging": null, "configFiles": null, "category": "service", "updatedAt": "2026-09-02", "risk": { "score": 40, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "use-webmcp-tool", "name": "use-webmcp-tool", "vendor": "npm", "description": "A small React hook that registers a WebMCP tool when a component mounts, keeps its schema current as props change, and unregisters it on unmount. It makes the tool surface a function of the rendered UI, which is the right default: tools disappear when the screen that backs them does.\n\nThe capability surface is browser control, inherited from the API it wraps. The design consideration it surfaces is scoping. Because registration is tied to component lifecycle, a tool mounted inside an authenticated route is only present while that route is rendered — a meaningfully tighter surface than registering everything globally at page load. Prefer that pattern; a permanently-registered `deleteProject` tool is reachable from every page an agent wanders onto.", "website": "https://www.npmjs.com/package/use-webmcp-tool", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "browser:control" ], "packaging": { "manager": "npm", "packageName": "use-webmcp-tool" }, "configFiles": null, "category": "library", "updatedAt": "2026-09-02", "risk": { "score": 40, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "webmcp-bridge", "name": "WebMCP Bridge", "vendor": "H3manth", "description": "WebMCP Bridge projects tools from a remote MCP server into the browser page API, so an agent driving the page can call server-side MCP tools through the same interface it uses for page-declared ones. It stitches the two halves of the ecosystem — hosted MCP servers and in-page WebMCP tools — into a single tool list.\n\nThat convenience is also a trust boundary being erased. Tools that used to require a configured MCP client, with whatever approval flow that client imposes, become callable from a web page. The bridge declares browser control and outbound network access. Anyone deploying it should be explicit about which remote servers are bridged and to which origins, because a page that can reach a filesystem or shell MCP server through a bridge has effectively been granted those capabilities.", "website": "https://github.com/h3manth/webmcp-bridge", "repository": "https://github.com/h3manth/webmcp-bridge", "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "browser:control", "network:outbound" ], "packaging": null, "configFiles": null, "category": "bridge", "updatedAt": "2026-09-02", "risk": { "score": 40, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "webmcp-types", "name": "webmcp-types", "vendor": "npm", "description": "TypeScript declarations for the experimental WebMCP browser interfaces. It ships types only — no runtime code — so applications can compile against the API before it stabilises without reaching for `any`.\n\nAs a types-only package it declares no runtime capabilities and carries essentially no direct risk; it is catalogued because it appears in the dependency tree of most WebMCP projects and reviewers will encounter it. The one thing worth checking is version drift: the underlying API is experimental, and types that describe an older shape will happily compile code the browser then rejects at runtime.", "website": "https://www.npmjs.com/package/webmcp-types", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [], "packaging": { "manager": "npm", "packageName": "webmcp-types" }, "configFiles": null, "category": "library", "updatedAt": "2026-09-02", "risk": { "score": 40, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "webmcp-cool", "name": "webmcp.cool", "vendor": "Community", "description": "A directory of WebMCP-enabled sites that is itself WebMCP-enabled: it publishes JSON discovery and query tools so an agent can ask which sites expose which tools, rather than a human browsing a list. It functions as the ecosystem's index.\n\nFor defenders it is a useful reconnaissance resource — the fastest way to see how quickly the agent-callable web is growing and which categories of site are adopting it. It declares outbound network access. The same property makes it worth watching: a machine-readable index of pages that expose tools to agents is exactly the input an autonomous crawler would want, and inclusion in it is effectively an invitation.", "website": "https://webmcp.cool", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "network:outbound" ], "packaging": null, "configFiles": null, "category": "directory", "updatedAt": "2026-09-02", "risk": { "score": 40, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "wordlift-ai-audit", "name": "WordLift AI Audit", "vendor": "WordLift", "description": "A live service that runs an agent-readiness review of a site — checking structure, machine-readable metadata, and how legible the page is to an AI agent — and exposes that review itself as WebMCP tools, so an agent can request the audit and read the findings without a human in the loop.\n\nIt is one of the few production services in the WebMCP ecosystem rather than a demonstration, which is why it is catalogued. It declares outbound network access and browser control. The data-flow question to ask before pointing it at anything sensitive is the usual one for hosted analysis tools: the URLs you submit, and whatever the crawler can reach from them, leave your perimeter.", "website": "https://wordlift.io", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "browser:control", "network:outbound" ], "packaging": null, "configFiles": null, "category": "service", "updatedAt": "2026-09-02", "risk": { "score": 40, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "webmcp-evals", "name": "WebMCP Evals", "vendor": "GoogleChromeLabs", "description": "A CLI evaluation harness for WebMCP tool surfaces. It drives an agent against a page's registered tools and checks whether the agent selects the right tool and supplies valid arguments — the two failure modes that make an otherwise correct tool surface useless in practice.\n\nIt runs locally, driving a browser and writing result files, so it declares browser control, filesystem writes, and outbound network access for the model calls. Treat its reports as a design signal rather than a security control: an eval suite tells you agents can use your tools correctly, not that a hostile agent cannot use them harmfully. Those are different questions, and only the first one has a harness.", "website": "https://github.com/GoogleChromeLabs/webmcp-evals", "repository": "https://github.com/GoogleChromeLabs/webmcp-evals", "documentationUrl": null, "license": null, "version": null, "trustLevel": "official", "capabilities": [ "browser:control", "filesystem:write", "network:outbound" ], "packaging": null, "configFiles": null, "category": "testing", "updatedAt": "2026-09-02", "risk": { "score": 20, "band": "low", "signals": [ { "id": "trust-official", "kind": "trust", "label": "Published by the vendor", "contribution": -40 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: filesystem:write", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "codex-modeling-studio", "name": "Codex Modeling Studio", "vendor": "OpenAI", "description": "A browser-based 3D studio in which an agent can inspect scene geometry and materials and edit them through declared tools, while the user watches the viewport update. Part of OpenAI's set of WebMCP reference applications demonstrating agent-native interfaces beyond text.\n\nThe pattern it demonstrates — an agent with structured read and write access to live application state — is the one that generalises. Its declared capabilities are browser control and outbound network access, and the work stays inside the page. The security question it raises for real applications built this way is provenance: when a model and a human both mutate the same document through the same tools, the application needs to record which changes came from which, or review becomes impossible.", "website": "https://openai.com", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "official", "capabilities": [ "browser:control", "network:outbound" ], "packaging": null, "configFiles": null, "category": "reference-app", "updatedAt": "2026-09-02", "risk": { "score": 10, "band": "low", "signals": [ { "id": "trust-official", "kind": "trust", "label": "Published by the vendor", "contribution": -40 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "le-petit-bistro", "name": "Le Petit Bistro", "vendor": "GoogleChromeLabs", "description": "The canonical declarative-API demonstration: a restaurant booking page whose ordinary HTML form is annotated so that its validation rules and submit action become a WebMCP tool. No JavaScript tool definitions, just markup an agent can read.\n\nIt matters because the declarative path is the one most sites will take — annotating forms is cheap, and every form on the web is a candidate. That is also the concern: form annotation turns existing submit handlers into agent-callable endpoints, and most sites have more forms than they remember. It declares browser control. Before annotating, enumerate what each form actually triggers; \"book a table\" and \"cancel subscription\" are the same shape in HTML.", "website": "https://github.com/GoogleChromeLabs/webmcp", "repository": "https://github.com/GoogleChromeLabs/webmcp", "documentationUrl": null, "license": null, "version": null, "trustLevel": "official", "capabilities": [ "browser:control" ], "packaging": null, "configFiles": null, "category": "reference-app", "updatedAt": "2026-09-02", "risk": { "score": 10, "band": "low", "signals": [ { "id": "trust-official", "kind": "trust", "label": "Published by the vendor", "contribution": -40 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "openai-margin-editor", "name": "Margin Editor", "vendor": "OpenAI", "description": "A local note editor in which the agent has its own identity: it creates notes and responds in the margin as a distinct participant rather than silently editing the user's text. A deliberate demonstration that agent-native does not have to mean agent-invisible.\n\nThat identity separation is the interesting security property. When agent output is attributable and spatially separated from human content, prompt-injected text the agent produces is visibly the agent's, not the user's — which matters enormously for documents that later feed other systems. Declared capabilities are browser control and outbound network access. It is catalogued as the design pattern worth copying: mark what the model wrote.", "website": "https://openai.com", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "official", "capabilities": [ "browser:control", "network:outbound" ], "packaging": null, "configFiles": null, "category": "reference-app", "updatedAt": "2026-09-02", "risk": { "score": 10, "band": "low", "signals": [ { "id": "trust-official", "kind": "trust", "label": "Published by the vendor", "contribution": -40 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "urbanestates-webmcp", "name": "UrbanEstates", "vendor": "GoogleChromeLabs", "description": "A property-search reference application exposing location, price, amenity, and filter tools over a map interface, so an agent can narrow a listing set the way a user would with the filter panel.\n\nIt represents the read-mostly category of WebMCP surface — query tools over a public catalogue, no state mutation — which is the safest way for a site to start. Declared capability is browser control. The residual consideration is inference rather than action: query tools give an agent efficient, structured access to a dataset, so a site publishing them should be comfortable with the whole dataset being enumerated quickly and cheaply, because it now can be.", "website": "https://github.com/GoogleChromeLabs/webmcp", "repository": "https://github.com/GoogleChromeLabs/webmcp", "documentationUrl": null, "license": null, "version": null, "trustLevel": "official", "capabilities": [ "browser:control" ], "packaging": null, "configFiles": null, "category": "reference-app", "updatedAt": "2026-09-02", "risk": { "score": 10, "band": "low", "signals": [ { "id": "trust-official", "kind": "trust", "label": "Published by the vendor", "contribution": -40 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "openai-verdant-market", "name": "Verdant Market", "vendor": "OpenAI", "description": "A reference grocery storefront exposing search across roughly 110 products and tools for managing a cart shared between the shopper and the agent. It models the commerce case: the agent does not scrape the catalogue or synthesise clicks, it calls `searchProducts` and `addToCart`.\n\nCommerce is where WebMCP's risk becomes concrete. A cart tool is state-changing and sits inside a session that will eventually reach checkout, so the boundary between \"agent helped me shop\" and \"agent bought something\" is a single tool definition. It declares browser control and outbound network access. Real storefronts adopting this pattern should keep irreversible steps — payment, address changes — behind explicit human confirmation rather than behind another tool.", "website": "https://openai.com", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "official", "capabilities": [ "browser:control", "network:outbound" ], "packaging": null, "configFiles": null, "category": "reference-app", "updatedAt": "2026-09-02", "risk": { "score": 10, "band": "low", "signals": [ { "id": "trust-official", "kind": "trust", "label": "Published by the vendor", "contribution": -40 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "webmcp-flow", "name": "WebMCP Flow", "vendor": "Vercel", "description": "An architecture canvas from Vercel where the diagram itself is agent-callable: tools cover creating nodes, drawing edges, labelling, and running layout, so a model can build and rearrange a diagram from a description rather than emitting an image.\n\nIt is a good illustration of the low-risk end of the WebMCP spectrum. The tools mutate a canvas, not a bank account; the declared capability is browser control with outbound network access for the model. Catalogued as a reference point: when reviewing a WebMCP surface, the question is never \"does it expose tools\" but \"what do the tools reach\", and a diagram editor and a checkout flow deserve very different answers.", "website": "https://vercel.com", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "official", "capabilities": [ "browser:control", "network:outbound" ], "packaging": null, "configFiles": null, "category": "reference-app", "updatedAt": "2026-09-02", "risk": { "score": 10, "band": "low", "signals": [ { "id": "trust-official", "kind": "trust", "label": "Published by the vendor", "contribution": -40 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "webmcp-page-agent", "name": "WebMCP Page Agent", "vendor": "GoogleChromeLabs", "description": "A Gemini-powered controller that accepts natural language and drives whatever WebMCP tools the current page has registered. It is the reference demonstration of the full loop: a page publishes tools, a model reads them, the user types an intent, the model calls tools until the intent is satisfied.\n\nThis is the clearest illustration of why WebMCP belongs in a risk catalog. The agent's context includes page content, and page content is attacker-influenceable on any site that renders user input. The controller declares browser control and outbound network access. Anything that can get text in front of this agent is one injection away from calling the page's tools with arguments of its choosing — inside a session that is already authenticated.", "website": "https://github.com/GoogleChromeLabs/webmcp", "repository": "https://github.com/GoogleChromeLabs/webmcp", "documentationUrl": null, "license": null, "version": null, "trustLevel": "official", "capabilities": [ "browser:control", "network:outbound" ], "packaging": null, "configFiles": null, "category": "reference-app", "updatedAt": "2026-09-02", "risk": { "score": 10, "band": "low", "signals": [ { "id": "trust-official", "kind": "trust", "label": "Published by the vendor", "contribution": -40 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "webmcp-polyfill", "name": "WebMCP Polyfill", "vendor": "GoogleChromeLabs", "description": "The WebMCP Polyfill is a compatibility layer that emulates the experimental WebMCP browser API in browsers that do not yet ship it. WebMCP lets a page declare structured tools — either as annotated HTML forms or as JavaScript functions with JSON schemas — so an AI agent can call them directly instead of guessing at the DOM. The polyfill implements that surface in userland, which is how most sites currently experiment with the API ahead of an origin trial.\n\nThe risk to reason about is not the polyfill's own code so much as what it turns on. Once a page registers tools, any agent driving that browser can enumerate and invoke them inside whatever session the user already has open — logged in, cookied, and authorized. A prompt-injected agent that reaches a page with a `submitOrder` or `transferFunds` tool does not need to defeat authentication; the page has already handed it a typed, documented button. Treat every registered tool as an unauthenticated endpoint reachable by anything that can influence the agent's context.", "website": "https://github.com/GoogleChromeLabs/webmcp-polyfill", "repository": "https://github.com/GoogleChromeLabs/webmcp-polyfill", "documentationUrl": null, "license": null, "version": null, "trustLevel": "official", "capabilities": [ "browser:control", "network:outbound" ], "packaging": null, "configFiles": null, "category": "library", "updatedAt": "2026-09-02", "risk": { "score": 10, "band": "low", "signals": [ { "id": "trust-official", "kind": "trust", "label": "Published by the vendor", "contribution": -40 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "webmcp-radar", "name": "WebMCP Radar", "vendor": "Google", "description": "WebMCP Radar is a Chrome extension that detects whether the page you are on registers WebMCP tools, shows how many, and lets you inspect each tool's name, description, and input schema. It is the quickest way to answer \"does this site expose an agent surface, and what can it do?\" without reading the page's JavaScript.\n\nFor a security reviewer it is a discovery instrument rather than an attack surface: it reads what the page has already published. Its capability profile is browser control — it operates inside pages you visit — plus outbound network access. The interesting output is the finding, not the tool: a commerce or banking page that quietly registers state-changing tools is a materially different risk than one exposing read-only search, and Radar is how you tell the two apart before an agent ever touches them.", "website": "https://chromewebstore.google.com/", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "official", "capabilities": [ "browser:control", "network:outbound" ], "packaging": null, "configFiles": null, "category": "browser-extension", "updatedAt": "2026-09-02", "risk": { "score": 10, "band": "low", "signals": [ { "id": "trust-official", "kind": "trust", "label": "Published by the vendor", "contribution": -40 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "webmcp", "slug": "webmcp-smart-home", "name": "WebMCP Smart Home", "vendor": "GoogleChromeLabs", "description": "A smart-home dashboard that reveals camera, climate, and energy controls as WebMCP tools, and lets an agent rearrange the dashboard as well as operate it. The demonstration extends past reading state into changing the physical environment.\n\nThis is the high-consequence end of the reference set, and worth catalogued attention for that reason alone. Tools that unlock, disarm, or view cameras are not recoverable the way a shopping cart is, and the agent invoking them is reading a page whose content may not be fully trusted. It declares browser control and outbound network access. Any real deployment of this shape needs per-tool authorization that is independent of the agent's context — the model should be able to request the action and still not be able to perform it unattended.", "website": "https://github.com/GoogleChromeLabs/webmcp", "repository": "https://github.com/GoogleChromeLabs/webmcp", "documentationUrl": null, "license": null, "version": null, "trustLevel": "official", "capabilities": [ "browser:control", "network:outbound" ], "packaging": null, "configFiles": null, "category": "reference-app", "updatedAt": "2026-09-02", "risk": { "score": 10, "band": "low", "signals": [ { "id": "trust-official", "kind": "trust", "label": "Published by the vendor", "contribution": -40 } ], "dangerousCombos": [] }, "dangerousCombos": [] } ] }