Agentready Network

The login you already have is the API. Agents investigate, humans authorize, receipts prove it.

Comment

The problem nobody has budget for

Every operations team lives inside sites that will never ship an API for them. Monitoring in Grafana. Customer commitments in Cal.com. Payer portals, vendor consoles, admin dashboards. The person holding the session can see everything and change anything, but their agent can do nothing except screenshot the screen and guess where to click.

WebMCP fixes this for sites that adopt it. Today that is roughly none of them. We measured three real open-source products, 522k lines of code, 429 places where a tool obviously belongs, and zero WebMCP registrations.

So we asked a different question. What if the user adopts WebMCP for the site?

The reframe

WebMCP turns the login you already have into an API. A signed-in tab already carries every credential and permission the human has. If that tab registers tools with document.modelContext.registerTool, the agent gets a typed, narrow, inspectable interface to the site, and the vendor never has to ship a line of code.

Adoption inverts. It no longer waits on ten thousand vendors. It happens one user, one tab, one reviewed pack at a time.

What Agentready Network does

Agentready Network is a local-first registry and runtime of reviewed action packs. A pack describes what a site can do, on exactly which origin, with which risk labels. The runtime turns that pack into live WebMCP tools inside the user's own signed-in session, then wraps every call in the safety the vendor never provided:

  • Exact origins. A pack binds to one host and a reviewed fingerprint. Drift fails closed.
  • Declarative, never executable. Manifests are JSON. The registry cannot ship code into your browser.
  • Bounded, untrusted output. Results are allowlist-projected, byte-capped, and labeled contentTrust: "untrusted". Tool output is content, not instruction.
  • Human authority on consequences. Reads flow. Writes need a preview. Consequential actions need one exact, single-use approval bound to origin, tool, and normalized arguments. Change an argument and the grant is void.
  • Verified closure. After a consequential action an inspector reads authoritative state and issues a receipt with no cookies, secrets, or raw bodies. Unknown outcome is reported as in_doubt, never as success.

One concrete job, end to end

The demo is not a feature tour. It is one incident.

  1. An alert fires in Grafana. Customer bookings in Cal.com are about to be affected. Neither site has WebMCP.
  2. The agent discovers the reviewed Grafana and Cal.com packs, installs them for this origin, and reads authoritative state. It never receives a credential.
  3. The agent prepares the exact continuity action and states what will change and how it will be inspected. The incident is still investigating.
  4. The human grants that exact action once, from a control the agent cannot reach.
  5. The agent executes once. The inspector verifies and issues one receipt. The incident is resolved.
  6. We poison the fingerprint. The pack refuses to run. We export the recorder draft. Every secret is gone before it can be published.

Agents investigate. Humans authorize. Outcomes are verified. That is the whole product.

What people and agents can now do together that they could not before

  • Work a real incident across two unrelated vendor sites with no API contract between them. The user is the integration layer.
  • Let an agent read freely and prepare freely, while every consequential step waits for a human decision the agent physically cannot forge.
  • Hand a reviewer a receipt, not a screenshot, as proof of what changed.
  • Teach a site once by observing its own traffic, then reuse that pack every session.

Why WebMCP, specifically

Screenshot-and-click pays the full cost on every step: a screenshot, a vision pass, a click that misses when the viewport shifts. We measured it. Creating one Grafana data source took nine browser actions and 55 seconds by DOM driving, and one WebMCP tool call in 20 milliseconds. A whole diagramming task took 44 calls versus 5. These are single-trial measurements from our audit work, not a benchmark suite, but the shape is unmistakable. The cost moves from per-action to per-app, and it never comes back.

WebMCP also gives us the one thing a bookmarklet never had: a standard discovery surface. Any agent that speaks document.modelContext finds our tools without knowing we exist.

How we built it

  • Registry, Pack Lab, and runtime in plain HTML, CSS, and JavaScript. No framework.
  • Every tool is registered with the current imperative API, document.modelContext.registerTool(tool, { signal }), so tools unregister cleanly when a view unmounts.
  • A Chrome MV3 extension injects reviewed read tools into the exact controlled Cal.com and Grafana origins and bridges receipts back to the registry.
  • Reviewed adapters for Cal.com and Grafana were reverse-engineered on the wire, not from source. The recorder wraps fetch and XMLHttpRequest, clusters observed traffic, drafts tools, auto-flags mutating endpoints, and strips secrets before anything is published.
  • Approval, inspection, drift, and redaction are enforced in the shared runtime, so every pack inherits them and no pack can opt out.
  • Node's built-in test runner covers the trust boundaries. All tests pass on the submitted commit.

What we deliberately did not claim

  • The public judge path is a deterministic fixture so nobody needs an account. The same runtime drives the real Cal.com and Grafana adapters against controlled localhost instances; the video shows the controlled Grafana and Cal.com state alongside the public lab.
  • The extension checkpoint is read-only. Remembered approvals, arbitrary-site install, generic DOM automation, and automatic rollback are out of scope.
  • Figma taught us the frontier. Its control plane is reachable in-session; its canvas rides a binary WebSocket inside a Worker that no page-context patch can see. We published only what we proved and marked canvas manipulation unsupported.

What we learned

Discovery is observation, not code reading. Every tool we guessed from source was wrong. Every tool we drafted from the wire worked. Minification cannot rename what crosses the network.

Injection inverts the safety burden onto the installer. The vendor never audited these tools, so we had to. That is why approval, inspection, and redaction live in the runtime and not in the pack.

What is next

Persist packs across sessions in the extension. Chain packs across sites so one agent can read portal A and act in portal B. Generalize the approval contract into a policy layer: read anything, never pay, never cancel, never touch what a human pinned. The first vertical we want to ship is healthcare payer portals, the most session-locked, human-attestation-gated surfaces on the web.

Testing instructions for judges

No credentials are needed. Open the live site in ChatGPT's browser or in Chrome with the WebMCP flag enabled, follow the 90-second path in the README, and use Reset between runs. Local run: npm test, then python3 -m http.server 8788 and open /site/.

Built With

Share this project:

Updates

Submission history