IntentLock

Inspiration

AI agents can perform real actions on websites, but malicious webpage content may try to change what the human requested. IntentLock explores how websites can give agents freedom while keeping humans in control.

What it does

A human sets purchasing rules such as:

• Maximum total: $100
• Quantity: 1
• Delivery: Office A
• Vendors: Approved only

The agent may choose a suitable product. If webpage content tells it to order five items or change the address, IntentLock returns BLOCK with the exact reasons.

Valid actions follow:

Agent proposes → Website verifies → Human confirms → Execute once

If the agent needs more authority, it must request permission from the human.

How we built it

IntentLock registers five WebMCP tools:

get_mission
search_products
prepare_checkout
request_authorization_change
commit_checkout

The application uses React, TypeScript, ChatGPT Sites, Cloudflare D1, and WebMCP. The optional GPT-4o mini feature explains product choices but cannot approve, block, or execute actions.

Challenges we ran into

The main challenge was showing that IntentLock is not simply a product filter. The agent proposes a real action, the website checks it against saved human rules, and execution requires confirmation. We also implemented mission versions, trusted catalog values, expiring tokens, and execute-once protection.

Accomplishments that we're proud of

• Five working WebMCP tools
• ALLOW, BLOCK, and UNDETERMINED results
• Clear explanations for blocked actions
• Human-controlled permission changes
• Prepare, confirm, and commit workflow
• Replay and stale-action protection
• Public deployment and automated tests

What we learned

WebMCP tools are more than a better way for agents to navigate websites. Their structured handlers can become enforcement points. We also learned that LLMs are useful for explanations, while important authorization decisions should remain deterministic.

What's next for IntentLock

Next, IntentLock could become a reusable WebMCP security library supporting authenticated users, signed delegation rules, real commerce integrations, cross-site provenance, organizational budgets, and domains such as email, travel, finance, and cloud operations.

Built With

• chatgpt
• gpt
• next.js
• openai
• react
• tailwind
• typescript
• webmcp