Lyrashield AI — WebMCP Assurance tool

Find risky WebMCP tool definitions, review a proposed change with your agent and rerun the check. Source stays in your browser, you decide what to apply.

Comment

Why we built it

The unsafe sample in Lyrashield's WebMCP Security Lab includes a tool named delete_user. It declares readOnlyHint: true, sends a DELETE request and sets exposedTo: ["*"].

We built WebMCP Assurance for developers adding browser-agent tools to their apps. A tool's description, input contract, permissions and implementation can disagree. We wanted developers to find those disagreements, inspect a proposed change and check the result before release.

Try the review loop

Open the free Security Lab. No account or API key is required. Load the unsafe sample and choose Check locally. The Lab parses the source in your browser and evaluates 14 deterministic controls.

The sample produces seven controls marked DETECTED. Open Rewrite, select WEBMCP-03, and prepare the change. The preview replaces exposedTo: ["*"] with exposedTo: []. You review the diff, then choose Apply in memory and rerun.

The exposure control becomes NO FINDING; six other detected controls remain. Undo restores the original sample. The change affects the local working copy. It does not edit a repository or establish that the tool is safe.

How people and agents work together

In a browser with WebMCP enabled, the Lab registers two page tools:

  • analyze_webmcp_source analyzes the current local input or the built-in unsafe sample and returns a bounded summary.
  • prepare_webmcp_rewrite prepares a change for a selected detected control and returns whether human review is required.

The agent can work on the source already loaded in the page without asking the developer to paste it into a conversation. Raw source and the rewrite diff stay in the human interface; the tools return summaries and rewrite metadata. A visible activity record shows whether a call completed, failed or was cancelled. The developer keeps the Apply and Undo controls.

WebMCP fits this workflow because the agent and developer use the same page state. The agent has named operations with defined inputs, and the developer can inspect the result in place. Browsers without WebMCP retain the manual workflow.

The authenticated Lyrashield app also implements page-specific tools to review launch readiness, filter or explain visible findings and prepare a scan form. Preparation leaves execution to the human Start control and existing server authorisation. The public Lab is the no-login judging path.

How we built it

A shared TypeScript analyser discovers supported imperative registrations and declarative forms, builds a versioned tool inventory, and evaluates the controls. They cover behaviour and annotation mismatches, cross-origin exposure, confirmation, validation, data bounds, cancellation, cleanup, embedded credentials, instruction-shaped contract text and specification drift.

The full analyser feeds the Lab, repository scanning, CLI/SARIF output, and WebMCP coverage receipts in reports. The self-contained GitHub Action runs a documented subset and blocks changed WebMCP mutation code it cannot structurally assess.

The Lab loads its TypeScript and HTML parsers in a dedicated Worker when analysis begins. Its native tools register through document.modelContext.registerTool, validate inputs, support cancellation and return bounded results. Source selected or pasted into the Lab is processed locally.

The public MIT-licensed repository contains the implementation. Start with the analyzer, the Lab tools, and the dashboard adapter.

What we learned

Rewrite safety required more work than generating a diff. The implementation checks that the source still matches the analysed inventory, limits edits to unambiguous wildcard-exposure cases, then analyses the proposed result before returning a patch. Unsupported cases remain unresolved. That constraint gives the developer a small change they can inspect.

We also reduced the Lab from five overlapping agent tools to two focused operations. Apply, Undo, export and other human controls remain visible in the page.

Codex helped with design review, implementation, regression tests, adversarial review, CI diagnosis, and release checks. The WebMCP controls and rewrite decisions run deterministically.

Work added during the challenge

LyraShield AI existed before The WebMCP Challenge. The pre-existing platform, billing, generic scanner, and dashboard are not claimed as hackathon work. During the submission period, we built and hardened the WebMCP-specific assurance layer: • A deterministic WebMCP analyzer and public browser-local Security Lab, where selected or pasted source stays in the browser. • WebMCP tools for local analysis and review-required rewrite preparation, including Chrome callback compatibility. • Repository scanning, CLI/SARIF output, and a fail-closed GitHub Action subset for structurally assessable WebMCP changes. • Page-scoped authenticated dashboard tools with visible activity records. Agents can prepare permitted state, but a human must explicitly start durable or resource-consuming work. • Fourteen controls covering annotation/behavior mismatch, exposure, origin isolation, confirmation boundaries, embedded credentials, prompt-injection text, specification drift, contract budgets, and related WebMCP risks. • A bounded rewrite path: only a statically checked, unambiguous wildcard-exposure case can produce a rewrite proposal. Applying it remains in-memory and human-controlled; all other cases stay review-required. We also extended the surrounding evidence workflow during this period: Launch Gate verdicts, signed shareable readiness reports, CLI readiness verdicts, an AI-built failure taxonomy, a server-generated fix and retest path, and explicit scope-limited results that never treat a partial assessment as launch-ready. Recent work improved judge usability and public clarity: WebMCP visibility in navigation, responsive navigation fixes, theme-token pricing and page polish, updated public explanation and control-count parity, plus refreshed demo and submission documentation. Key merged evidence includes WebMCP implementation and compatibility work in PRs #498, #499, and #512; launch-assurance work in PRs #555 through #561; WebMCP submission hardening in #569 and #570; and recent correctness and usability updates in #585, #587, #588, and #589. LyraShield reports bounded, deterministic evidence. It does not claim universal coverage, a security guarantee, or independent verification of every result.

Scope and next work

The Lab checks selected source. Dynamic behaviour, server authorisation, and obfuscated or unsupported registrations can remain outside its coverage. Results are deterministic detections, not independent verification or a security guarantee. Runtime drift protection remains future work.

The next validation step is a recorded native-client invocation of both public tools, with their visible activity records and human Apply boundary. The completed manual Brave test covers analysis, rewrite, rerun and Undo. It does not establish native WebMCP execution.

Built With

Share this project:

Updates

Submission history