FlightSweeper

• 

  Untrusted supplier content cannot override the stored refundability and price rules.

• 

  The issued sandbox ticket records policy evidence and resolves a duplicate request safely.

• 

  Mission authority and the WebMCP-connected agent workflow.

FlightSweeper lets a traveler delegate a complete sandbox flight purchase in one browser conversation—without letting the agent choose its own authority.

The traveler sets the route, date, arrival deadline, cabin, connection limit, refundability rule, purchase cap, and execution mode. The agent searches, compares, and executes. FlightSweeper independently approves or denies the transaction and records why.

The result is practical delegation with visible control: the traveler does not need to click through the booking flow, and the agent cannot silently expand the traveler’s limits.

The proof in one transaction

One supplier result contains an instruction telling the agent to ignore the traveler’s refundability rule. FlightSweeper marks the supplier output as untrusted and evaluates the exact quote against the stored mandate. The cheaper offer is denied.

The agent then selects an eligible offer, refreshes the quote, requests policy evaluation, and issues one idempotent sandbox ticket. Repeating the purchase returns the original ticket instead of creating another transaction. The traveler can revoke future authority without erasing the evidence.

This single flow demonstrates the core product idea: an agent can complete consequential work, but it cannot authorize itself.

Why WebMCP

Traditional browser agents infer controls from a visual interface. They can also carry stale or adversarial page content into a consequential action. WebMCP gives FlightSweeper a structured, page-scoped transaction surface with bounded inputs and explicit trust annotations.

The human and agent share the same visible transaction state. All 10 tools remain discoverable so the agent can plan the complete workflow. Application-side checks expose the valid next actions and reject premature or prohibited calls.

The responsibility split is explicit:

• The traveler owns purchasing authority.
• The agent owns search and execution.
• Suppliers own inventory.
• FlightSweeper owns policy enforcement and transaction evidence.

A human can replace or expand the mandate. An agent can only narrow it. The traveler can revoke future authority at any time.

What the traveler and agent do together

The agent reads the mandate, searches sandbox inventory, compares visible offers, selects an exact quote, refreshes it, requests independent evaluation, purchases an eligible offer, and retrieves the receipt. The traveler watches the same mission, offer, authorization, and evidence states change on the page.

This makes a multi-step booking executable through one agent conversation while preserving the limits that matter to the traveler.

How we implemented WebMCP

The page registers 10 tools with document.modelContext.registerTool(), bounded input and result schemas, and accurate readOnlyHint and untrustedContentHint annotations. Every success returns data, mission status, and valid next actions. Every failure returns a typed error with the same state guidance. Human controls and WebMCP tools call the same application functions and persist state in versioned browser storage.

Tool callers provide mission, offer, and idempotency identifiers—not price, passenger, payment, or authorization claims. Before every consequential decision, FlightSweeper reloads the stored mission and exact quote. Authorization, denial, and booking receipts record the policy and quote versions, stored limits, offered values, rule results, actor, timestamp, and resolution.

We verified the complete lifecycle in ChatGPT desktop’s in-app browser and Chromium 151: adversarial denial, monotonic tightening, quote refresh, authorization, ticketing, replay, revocation, and receipt retrieval.

What we built during the challenge

Production FlightSweeper existed before the challenge. After the August 25, 2026 kickoff, we built this public, self-contained WebMCP Challenge Edition: sandbox inventory, the stable tool catalog, state-validated execution, the authority and policy engine, the adversarial fixture, durable evidence, repeat-safe ticketing, the browser interface, tests, documentation, and deployment. Production FlightSweeper remains private and unchanged.

The challenge edition never charges a card or creates an airline order. It demonstrates authority, policy enforcement, quote binding, revocation, and idempotency controls. A live provider connection would require additional provider, payment, identity, operational, and regulatory controls.

FinSync LLC operates FlightSweeper and is registered as a California Seller of Travel, CST 2172984-70. Registration as a seller of travel does not constitute approval by the State of California.

Built With

• css3
• html5
• javascript
• vercel
• vite
• webmcp