Skip to content

feat: WebMCP tools (@profullstack/webmcp) - #297

Merged
ralyodio merged 1 commit into
mainfrom
feat/webmcp
Nov 11, 2026
Merged

ralyodio merged 1 commit into
mainfrom
feat/webmcp

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Adds the @profullstack/webmcp embed to every page's head so an AI agent in the visitor's browser can use W3BS directly.

  • site_info, open_page (8 main pages), search_site (opens /search).
  • /mcp bridged (w3bs_search, resolve, inspect, verify, run, packages, browse, ask...). w3bs_publish and w3bs_revoke are excluded: they need a bearer token the page never has.
  • Declarative tools on the prompt, package, browse and network search forms (all GET, toolautosubmit).
  • CSP script-src names https://cdn.jsdelivr.net (test updated).

🤖 Generated with Claude Code

Every page's head: site_info, open_page, search_site (/search) and the
/mcp tools bridged (w3bs_publish and w3bs_revoke excluded: bearer-only).
Prompt, package, browse and net search forms are declarative tools.
CSP names cdn.jsdelivr.net.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio

Copy link
Copy Markdown
Contributor Author

Merging without the Actions run: every profullstack workflow has sat in queued since ~07:53 UTC today (no runner picks anything up, org-wide). Local checks on this branch: bun test (167, CSP test updated). The change only adds the WebMCP embed/attributes; a failed build on dev2 leaves the running stack in place. (riotcoder)

@ralyodio
ralyodio merged commit 37870cf into main Nov 11, 2026
3 of 7 checks passed
@ralyodio
ralyodio deleted the feat/webmcp branch November 11, 2026 08:25
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

1 finding(s) in the 4 file(s) this pull request changes.

MEDIUM: 1

Severity Rule Location
MEDIUM redos-nested-quantifier src/server.mjs:281
54 pre-existing finding(s) elsewhere in the repository — **HIGH**: 12 | **MEDIUM**: 31 | **LOW**: 11

Not introduced by this pull request.

Severity Rule Location
HIGH secret-database-url .github/workflows/ci.yml:23
HIGH sh-remote-script-execution de/share/bin/w3bs-de:241
HIGH js-unescaped-html-sink desktop/crates/w3bs-desktop/assets/control/app.js:163
HIGH js-ssrf-outbound-request desktop/crates/w3bs-desktop/assets/control/sw.js:21
HIGH sh-unquoted-expansion-destructive desktop/packaging/install.sh:106
HIGH sh-eval-expansion os/iso/overlay/usr/local/sbin/w3bs-os-install:119
HIGH sh-eval-expansion os/iso/overlay/usr/local/sbin/w3bs-os-install:125
HIGH sh-eval-expansion os/iso/overlay/usr/local/sbin/w3bs-os-install:143
HIGH sh-plaintext-download os/iso/overlay/usr/local/sbin/w3bs-os-install:499
HIGH sh-remote-script-execution package-manager/bootstrap/npm-cli-install.sh:35
HIGH tls-verification-disabled src/store.mjs:85
HIGH tls-verification-disabled training/hosted.mjs:25
MEDIUM sh-remote-script-execution de/install.sh:197
MEDIUM sh-remote-script-execution de/share/bin/w3bs-de:70
MEDIUM sh-remote-script-execution de/share/bin/w3bs-de:221
MEDIUM js-timing-unsafe-mac-compare native/client.mjs:105
MEDIUM sh-remote-script-execution os/debian/config/includes.chroot/usr/local/sbin/w3bs-os-install:723
MEDIUM sh-remote-script-execution os/debian/config/includes.chroot/usr/local/sbin/w3bs-os-install:734
MEDIUM sh-predictable-temp-path os/docker/check-desktop.sh:29
MEDIUM sh-remote-script-execution os/iso/overlay/usr/local/sbin/w3bs-os-install:912

…and 34 more; the full set is in the SARIF artifact.

Snippets are redacted; ThreatCrush never prints matched credential material.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant