HUMANLOCK

• 

• 

• 

Inspiration

We kept asking: what would a website look like if it required human and agent together, not as a gimmick but as the core mechanic?

HUMANLOCK is our answer. It borrows the tension of Keep Talking and Nobody Explodes and DEFCON-style puzzles, but rebuilt for WebMCP: the agent does not scrape the page. It calls tools that share the same UI state you see.

Human alone fails. Agent alone fails. Together, you open it.

Not a CAPTCHA. A CAPTCHA asks "are you human?" HUMANLOCK asks "what can only you do?"

What it does

HUMANLOCK is a vault with 5 locks. Each lock requires a capability the human or agent can't provide alone. Human alone fails. Agent alone fails. Together, you open it.

It is an experiment in shared agency on the web. Instead of asking whether an action belongs to a human or an agent, HUMANLOCK asks what each should be responsible for. WebMCP makes this possible by dynamically registering the agent tool required for each lock while the human and agent operate on the same state.

Live demo: https://humanlock.pages.dev/

Open in ChatGPT's in-app browser or Chrome Canary with #enable-webmcp.

Lock	Agent	Human	WebMCP tool
THE BLUR	Freeze the frame	Perceive the hidden detail	freeze_frame({ timestamp: 300 })
THE SWARM	Narrow the candidates	Choose the match	filter_by_vibe({ description: "most trustworthy" })
THE WHISPER	Transform the signal	Interpret it	sonify_to_spectrogram()
THE LIE	Audit the evidence	Decide whether to trust it	audit_truth()
THE HANDSHAKE	Synchronize	Provide the final interaction	align_quantum_lock() within 50ms

Stop cooperating for 30 seconds and the vault decays. Clear all five and you mint a co-signed HUMANLOCK certificate (shareable URL with human and agent signatures). Certificate links render without WebMCP.

Try it: open the demo, click Enter vault, and prompt your agent (calls are copyable in the app):

List my WebMCP tools and help me open this vault. Start with THE BLUR: freeze_frame({ timestamp: 300 })

How we built it

Static Vite and TypeScript SPA on Cloudflare Pages. No backend: all state is client-side.

Each lock registers exactly one WebMCP tool. When the lock changes, the available agent capability changes with it via document.modelContext.registerTool(). Agents discover tools through getTools() or toolchange listeners.

document.modelContext.registerTool({
  name: "freeze_frame",
  description:
    "Freeze the high-frame-rate blur canvas at a timestamp to reveal the hidden digit.",
  inputSchema: {
    type: "object",
    properties: {
      timestamp: {
        type: "number",
        description: "Timestamp in ms to freeze at (glitch window 280-340ms).",
      },
    },
    required: ["timestamp"],
  },
  execute: async (input) => {
    /* freeze canvas at input.timestamp; return revealed digit or miss */
  },
});

Each lock is an isolated module with typed JSON Schema inputs and deterministic success checks. No model in the lock loop.

Challenges we ran into

Symbiosis that feels fair: every lock had to fail for solo human and solo agent playtests, not just in theory. Tools must not leak the human's decision.

Dynamic tool lifecycle: registering and tearing down five tools without race conditions or stale tool lists.

THE HANDSHAKE timing: proving simultaneity with a 50ms window between human drag and agent tool call, with instant retries so live latency does not kill the demo.

WebMCP availability: experimental browser support means clear degraded UX when tools are unavailable (fail closed, no fake success).

What's next

HUMANLOCK is an experiment by Chitmark into what a future agent challenge could look like when the missing capability is human participation. We are exploring a reusable "human authorization" step for consequential actions (publishing, permission changes, data deletion) where the agent prepares and verifies, and the site enforces that a human decides. The vault is the playground; the primitive is the point.

Built by

HUMANLOCK · an experiment by Chitmark. Chitmark works on trust decisions for agent-mediated actions.

Repo: github.com/nonameuserd/webmcp-humanlock
Demo: https://humanlock.pages.dev/

Built With

• cloudflare
• typescript
• vite