AgentDesk

Agent Desk

Inspiration

WebMCP gives websites a direct, typed way to work with agents. But a production application may contain dozens or hundreds of operations. Publishing all of them at once creates a flat, expensive tool surface, makes selection less reliable, and places dangerous actions beside harmless reads.

AgentDesk started from a simple question: what if the WebMCP tool registry behaved like a task-aware interface instead of a static API dump?

What it does

AgentDesk is a capability-virtualization and governance runtime for WebMCP applications.

The Meridian Ops demo contains 79 internal capabilities across customers, orders, inventory, shipping, billing, support, and reports. The agent initially sees only four bootstrap tools. When it describes a task, AgentDesk:

ranks the catalog against the task and current application context;
dynamically registers up to five relevant, typed WebMCP tools;
retires stale tools while leaving structured tombstones for clients with cached tool lists;
explains unavailable actions and suggests what can make them possible;
separates reads, ordinary writes, and consequential actions;
returns approval-required immediately for consequential work instead of leaving a tool call hanging;
shows the human an exact before/after preview;
executes only after human approval and re-checks state at commit time;
returns durable receipts describing what actually changed;
supports reviewable multi-step plans, idempotency, verification, rollback, and human reconciliation when an outcome cannot be proven.

Guided execution keeps the agent and person in the same application: tool calls navigate to, reveal, and highlight the affected object while the structured result remains authoritative. A Baseline mode exposes the full catalog so judges can compare the two approaches using the same tasks and data.

Why WebMCP is essential

This experience depends on the page and the agent sharing one live application context. AgentDesk registers tools directly with document.modelContext; the browser page owns capability state, approval UI, and the visible business data. A server-only MCP integration cannot provide the same shared attention, dynamic page-scoped registry, or approval card beside the exact value being changed.

The result is a collaboration model that was difficult before: the agent can move quickly through structured operations while the human sees the affected state, governs consequential decisions, and receives proof afterward.

How we built it

The judged path is a TypeScript SDK, @agentdesk/webmcp, with no backend, database, model API, or external runtime service. A document-lifetime runtime owns the catalog, deterministic router, availability checks, policy engine, approvals, plans, audit events, receipts, and persistence. A single ToolSurfaceManager publishes capabilities through the WebMCP adapter; React only observes runtime state and renders the product experience.

Dynamic retirement uses abort signals and tombstone tools. A stable invoke_capability gateway covers clients whose discovery lags behind registry changes. Evidence is detached and frozen at system boundaries. Idempotency claims occur before dispatch, and any post-dispatch uncertainty becomes an explicit indeterminate state rather than a fabricated success or safe retry.

We also built a real-browser P0 harness that exercises native registration, same-turn dynamic tools, retirement, stale calls, re-registration, typed execution, approvals, and compatibility behavior.

Challenges

The hardest work was not registering a tool—it was making stateful tool lifecycles honest under retries, reloads, stale client snapshots, approval delays, partial failures, and interrupted rollback.

We repeatedly tested the boundaries where a system is tempted to overclaim: whether a write actually landed, whether a rollback truly restored prior state, whether evidence can be mutated, whether a repeated call can execute twice, and whether a benchmark accidentally rewards AgentDesk by construction. Those failures now have explicit domain states and regression tests.

Accomplishments

A working, WebMCP-native SDK rather than a one-page integration
A complete operations product spanning seven business domains
Task-scoped dynamic tool registration over a 79-capability catalog
Human approval with visual diffs and post-action receipts
Governed multi-step plans exposed through WebMCP
Guided execution that keeps human attention aligned with agent actions
A reproducible Baseline-versus-AgentDesk benchmark
Live validation in the Codex in-app browser and Chrome 152 with WebMCP enabled
An open-source MIT-licensed repository and static public deployment

What we learned

The registry itself can be an interaction surface. Registering, retiring, and rewriting capabilities based on task and state gives an agent clearer affordances than another layer of prompting. We also learned that governance needs more than a confirmation modal: it needs explicit acting identity, execution-time re-checks, idempotency, evidence, and a truthful representation of unknown outcomes.

What's next

AgentDesk can become an adoption layer for complex web applications: generated capabilities from existing application schemas, runtime-configurable routing, durable cross-session reconciliation, application adapters, and a browser extension that helps legacy sites expose governed WebMCP capabilities. The same model applies beyond operations software to editors, design tools, IDEs, and admin platforms.