trust-oracle

WMCP — turn websites into tools for AI agents

One URL → discover tools → connect an MCP client → evaluate trust.

Try WMCP · MCP Doctor · Read-only CLI · Native browser demo · MCP Trust Leaderboard · API docs

WMCP is a hosted URL-to-MCP gateway for Claude, Cursor, Codex and custom AI agents. It extracts candidate tools from public pages, structured data and documented APIs; exposes them over MCP; and offers separate trust grading for MCP servers. You can use the public service or self-host the Worker.

Not every website is compatible. Discovery is best-effort, and a discovered tool is not proof that an action can actually run, that the site permits it, or that it is safe. Authenticated live actions require authorization and applicable plan entitlements.

Try it in 30 seconds

Option 1: browser, no install. Paste a public URL into wmcp.sh/start, review the inferred tools, then choose whether to connect an MCP client.

Option 2: terminal, no dependencies. Node.js 18+ is sufficient after cloning:

git clone https://github.com/New1Direction/webmcp-anything.git
cd webmcp-anything

# Discover candidate tools using the hosted REST API.
node cli/wmcp.mjs inspect https://petstore3.swagger.io/api/v3/openapi.json

# Negotiate actual MCP and request tools/list (never tools/call).
node cli/wmcp.mjs mcp https://petstore3.swagger.io/api/v3/openapi.json

# Print a copyable MCP client configuration (no keys included).
node cli/wmcp.mjs config https://petstore3.swagger.io/api/v3/openapi.json

The CLI performs read-only requests. It does not install another agent, make purchases, or call any tool. Run the Node test command below to execute its tests and the browser demo smoke tests.

Option 3: cURL, no clone:

curl -sS 'https://wmcp.sh/api/v1/tools?url=https://petstore3.swagger.io/api/v3/openapi.json'

Only submit public URLs. The hosted service may fetch, cache, or index submitted sources; do not send credentials, signed query parameters, private files or sensitive customer data.

Connect an MCP client

WMCP provides a real MCP endpoint, not merely JSON that looks like a tool schema. Encode the URL as base64url, then use the per-URL address format:

https://wmcp.sh/mcp/u/<base64url-encoded-URL>

Generate a client configuration for a real URL:

node cli/wmcp.mjs config https://petstore3.swagger.io/api/v3/openapi.json

The generated JSON has this shape:

{
  "mcpServers": {
    "wmcp": {
      "type": "http",
      "url": "https://wmcp.sh/mcp/u/<base64url-encoded-URL>"
    }
  }
}

Replace the example URL placeholder with the actual CLI output. The endpoint implements JSON-RPC initialize, tools/list and authorized tools/call. Discovery reads are free within rate limits. Live execution requires authorization, and not every inferred action is executable. Pass paid-plan keys using your MCP client's Authorization header support—never place keys in URL parameters or commit them to Git.

Multiple public URLs may be composed through the /mcp/url endpoint. See the API reference, architecture, and self-hosting guide.

How the gateway works

Public URL
   |
   +-- Shopify storefront/product adapter
   +-- OpenAPI / Swagger compiler
   +-- Crypto/data adapters for supported sources
   +-- Structured JSON-LD extraction
   +-- Best-effort LLM fallback, when configured
   |
   v
Schema + tools ---> Hosted MCP endpoint or JSON REST response
                           |
                      Client approval, auth & execution

Detection depends on each site's metadata, network accessibility and authentication. Client-side applications may require a separately installed browser integration.

WebMCP is not the same as backend MCP. The WebMCP draft uses document.modelContext to expose site-owned JavaScript tools in the browser. WMCP's current hosted product is primarily a backend URL adapter and MCP gateway. Native browser interoperability is being developed in PR #75; do not assume a remote MCP endpoint can execute browser-session tools without a consented session bridge.

Diagnose MCP servers in CI

WMCP Doctor checks a direct MCP HTTP endpoint without calling tools. It handles protocol initialization, session IDs, tool pagination, and basic input-schema hygiene. Use it as a lightweight CI preflight, not a formal audit or replacement for the official MCP Inspector.

node cli/wmcp.mjs doctor https://YOUR_MCP_HOST.example/mcp --json --strict

You can also save doctor --json output as a reviewed baseline, then use --baseline path --strict to flag MCP tool-contract changes in CI.

The endpoint is an example placeholder. Read the Doctor guide for supported checks, limits, and exit codes.

Live browser-native example

This repository also includes a small WebMCP taskboard with real, in-page state—three tools (list, add, complete) and a UI that updates when a tool runs.

cd examples/browser-demo
python3 -m http.server 8000

Open http://localhost:8000. In a supported Chrome/Edge build with WebMCP enabled, compatible browser agents can discover the page's registered tools. On unsupported browsers, the taskboard still works and reports that the native API is unavailable.

View the runnable example and instructions.

Independent MCP trust reports

The free MCP Trust Leaderboard examines supported MCP endpoints and publishes an A–F report covering observable protocol, tool and security signals. The trust system can detect changes in discovered tool definitions over time.

Trust grades are risk indicators, not security certifications. They do not imply an audit of every executable behavior or authorize an agent to act. Free grades are not sold; separate products offer deeper assessment and monitoring.

node cli/wmcp.mjs grade https://example.com/mcp

Developer integrations

Surface	Function	Docs
URL discovery	Best-effort extraction through public HTML and known adapters	REST API
Remote MCP	Connect compatible clients to URL-addressed tools	MCP quickstart
Native WebMCP demo	Site-authored tools using document.modelContext	Taskboard demo
Trust grading	Inspect observable MCP server signals	Leaderboard
Python SDK	Programmatic API client	Python
JavaScript SDK	Programmatic API client / model adapters	JavaScript
Browser extension	Retail-scoped browser extraction and QuickCatch flows	Extension

The installed extension's existing site coverage is not blanket all-site permission. A broader opt-in integration is proposed in PR #75.

Pricing and hosting

The open-source code is MIT-licensed. The hosted API has an anonymous free-read tier plus Builder ($39/mo), Pro ($99/mo), and Reseller ($299/mo). Scoped agent-readiness services are offered via Managed, starting at $499 for setup; ongoing work is quoted separately.

See self-hosting for a deployment you control. Hosted service entitlements and provider OAuth connections are separate from the open-source license.

Contribute

We want working integrations and tests, not unsubstantiated claims that a site is agent-ready. Good first contributions include read-only public-format adapters with fixtures; browser compatibility examples; protocol edge-case tests; and better errors, security or accessibility.

Start with CONTRIBUTING.md, the adapter contract, or the adapter wish list. Pull requests should include an executable test or reproduction wherever possible.

node adapters/_test/run.mjs
cd worker && npm install && npm run verify
# From the repository root:
node --test cli/*.test.mjs

Questions or bugs? Open an issue. If the toolkit saves you time, starring the repository helps more developers find it.

License: MIT. Not affiliated with browser vendors or the companies whose APIs are referenced.