Handrail WebMCP

Inspiration

AI agents should eventually help streamline day-to-day store operations, but a tool should never become a way to circumvent orders, refunds, price adjustments, etc., without restraint. With Handrail I aim to add more control by allowing the agent to investigate orders and propose actions that the merchant can ultimately approve and execute.

What it does

Handrail is a browser based store operations console. Agents can search orders, customers, policies, inventory, shipping, products, and sales data using WebMCP tools.

When the agent needs to perform an action like issue a refund or cancel an order, the agent cannot mutate the data. Handrail does validation and creates a parameter approved ticket. The merchant approves the action in the application and only then can the agent execute the same parameters.

The guided demo shows the refund for an order ORD-1042 and shows validation failures and request protections against requests that are mismatched or replayed.

How I built it

Handrail was built using Vite to speed up development and deployed as purely a browser based React application. Handrail also provides a fallback interface when WebMCP tools are not available as it registers 14 WebMCP tools.

The safety flow is implemented in the application logic:

agent suggestion → approval → exact parameter match → one time execution → confirmation

All demo data is held in memory, so it can be safely reset without a backend or payment integration.

Challenges I ran into

The biggest challenge was still making the approval step more meaningful than just a confirmation must be checked. An approval should be for the actual amount, the actual order and the actual operation, not a statement like an agent is going to “do this later”.

I dealt with this by freezing the canonical parameters for each ticket, validating them again at the time of ticket execution, preventing ticket replay, enforcing expiry, and recording both successful actions and denials in an activity log.

What I learned

Executable actions and audit receipts make sense between reaching out and approval. The executive semantics of an actual execution are very important when it comes to safe agent tooling, and this is more important than having a label like “read-only” or “write” on that action.