WebMCP Today

io.github.robertn702Published by GitHub account robertn702v0.3.1Updated Oct 24, 2026

Your agent gets trustworthy tools on sites without WebMCP — data-only packages you approve.

VerifiedSTDIODesktop onlyProductivity & WorkflowBrowser AutomationDeveloper Tools

Overview

AI-generated overview

Lets an assistant browse and publish WebMCP Today registry packages and, with a local bridge, invoke live WebMCP tools in a selected browser tab.

What you can do
The server exposes tools for registry discovery (looking up packages for a URL, browsing packages, retrieving a package at its latest version, viewing registry statistics), account and publishing actions (managing account-level package pins, publishing packages and appending versions, updating package metadata), and an optional live bridge that lists and focuses the user-selected visible Chrome or Brave tab, lists its live tools, and executes a selected tool. It also provides bridge administration tools to install, inspect, and remove the first-party native bridge on supported macOS browsers.
When to use it
Worth adding when an assistant needs to find or publish WebMCP Today packages, manage account-level package pins, or drive WebMCP tools in the user's active Chrome or Brave tab on macOS. Public package discovery works without credentials; account and publishing actions need an API key.
Requirements
Node.js 20 or later (or Bun) and npx to run the npm package @webmcp-today/mcp-bridge over stdio. The optional live bridge requires the WebMCP Today browser extension and first-party native host setup on macOS Chrome or Brave. Public discovery needs no credentials; authenticated account and publisher actions need WEBMCP_TODAY_API_KEY. The default registry is WEBMCP_TODAY_API_URL can point to another compatible endpoint.
Before you install
WEBMCP_TODAY_API_KEY is a secret for authenticated account and publisher actions; create it in WebMCP Today settings and keep it out of prompts, package definitions, and source control. Publishing and metadata updates change registry data, and pins do not install a package in the browser. Registry-injected tools make same-origin page requests with the page's authenticated cookies, so they can act as the signed-in site account; destructive tools keep their page-level window.confirm prompt…

Installation

In SourceWeft

  1. Open WebMCP Today in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

WebMCP Today MCP Bridge

@webmcp-today/mcp-bridge is an MCP server for WebMCP Today: a registry of packages that add WebMCP tools to supported sites through the WebMCP Today browser extension.

It lets an MCP client browse and publish registry packages, manage account-level package pins, and—when the optional local browser bridge is installed—discover and invoke live WebMCP tools in the user's selected browser tab.

Install and configure

Requires Node.js 20 or later. Configure any stdio-capable MCP client to run the package with npx:

json
{  "mcpServers": {    "webmcp-today": {      "command": "npx",      "args": ["--yes", "@webmcp-today/[email protected]"]    }  }}

The default registry is https://webmcp.today. Set WEBMCP_TODAY_API_URL only when using another compatible registry endpoint.

Registry API key (optional)

Public package discovery does not need credentials. Set WEBMCP_TODAY_API_KEY in the MCP server environment to use authenticated account and publisher actions, including package pins, publishing, and package metadata updates. Create an API key in WebMCP Today settings; do not put it in prompts, package definitions, or source control.

json
{  "mcpServers": {    "webmcp-today": {      "command": "npx",      "args": ["--yes", "@webmcp-today/[email protected]"],      "env": {        "WEBMCP_TODAY_API_KEY": "<your-api-key>"      }    }  }}

Capabilities

The server provides tools in these categories:

  • Registry discovery — look up packages for a URL, browse packages, retrieve a package at its latest version, and view registry statistics.
  • Account and publishing — inspect and manage account-level package pins; publish packages and append versions; update package metadata. These actions require an API key. An account pin does not install a package in the browser; the returned install link hands that explicit browser-consent step to the user.
  • Live WebMCP bridge — list and focus the user-selected visible Chrome or Brave tab, list its live tools, and execute a selected tool using the document and tool-list generations returned by discovery.
  • Bridge administration — install, inspect, and remove the first-party native bridge on supported macOS browsers.

Live browser bridge

The live bridge is optional. It requires the WebMCP Today extension and the first-party native host setup on macOS Chrome or Brave. After configuring the MCP server, call setup_webmcp_bridge with explicit approval, for example:

json
{ "browser": "chrome", "confirm": true }

Setup copies the bundled native host under ~/.config/webmcp-today and writes only this bridge's native-messaging manifest(s) in the browser's Application Support directories. Brave writes both its own manifest and a Chrome-compatibility manifest. It runs under Node 20 or later or Bun. Use get_webmcp_bridge_status to inspect the installation without exposing the bridge secret.

The bridge only operates on the user-selected active, visible Chrome or Brave tab. It does not enable WebMCP, run arbitrary JavaScript, proxy Chrome DevTools Protocol, or expose an HTTP port. Registry-injected tools make same-origin page requests with the page's authenticated cookies, so they can act as the signed-in site account. A page can still refuse injected WebMCP tools, and changing a page or its tools between discovery and execution requires discovery again.

The extension's local fallback can serve tools through this bridge without the current WebMCP testing flag. That flag is still required for Chrome's native agent to see injected tools in the current browser preview.

Confirmations and retries

  • Registry-injected tools marked as destructive retain their page-level window.confirm prompt; approve it in the selected tab.
  • setup_webmcp_bridge and uninstall_webmcp_bridge make no filesystem changes until called with confirm: true.
  • On execution-timeout, the browser may have completed the tool call: verify the result before retrying. dispatch-failed means the call was not dispatched and can be retried.
  • Removing a Brave installation intentionally leaves its Chrome compatibility manifest. Follow the tool's reported instruction to run the confirmed Chrome uninstall after closing both browsers before treating the bridge as fully removed.

Development

For repository development, install dependencies and run the package tests:

bash
bun installbun run --filter @webmcp-today/mcp-bridge test

Links

Source: packages/mcp/README.md at commit c65a11a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.3.1LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.