WebMCP Bridge ↗
WebMCP Bridge is a community-maintained WebMCP tool from H3manth. Anomity scores its risk at 40 out of 100 (medium).
Analysis summary
WebMCP Bridge is a community-maintained WebMCP tool from H3manth. Anomity scores its risk at 40 out of 100 (medium).
WebMCP Bridge projects tools from a remote MCP server into the browser page API, so an agent driving the page can call server-side MCP tools through the same interface it uses for page-declared ones. It stitches the two halves of the ecosystem — hosted MCP servers and in-page WebMCP tools — into a single tool list.
That convenience is also a trust boundary being erased. Tools that used to require a configured MCP client, with whatever approval flow that client imposes, become callable from a web page. The bridge declares browser control and outbound network access. Anyone deploying it should be explicit about which remote servers are bridged and to which origins, because a page that can reach a filesystem or shell MCP server through a bridge has effectively been granted those capabilities.
Why this entry scored 40 out of 100
This profile starts at the catalog's neutral base of 50. Because the entry is community-maintained, trust adjusts the score by -10. The entry declares no high-risk capabilities on its own, so capabilities add nothing. It matches no dangerous capability combinations. The clamped result is 40, placing it in the medium band.
Findings
-
Established community project Trust offset
Capabilities
Every capability the entry declares, with the security implication of each.
-
browser:controlBrowser controlDrives a browser session. Combined with credential access can impersonate the user on web services. -
network:outboundOutbound networkCan make outbound network requests. Required for hosted model providers and remote APIs; also the path for data exfiltration if combined with read access.