Inspiration
Job offers often mix ordinary details with missing context, urgency, payment requests, and invitations to move to unofficial channels. Under pressure, it is easy to confuse what a message actually says with an assumption. We built Offroof as a calm evidence workspace that preserves the wording, explains why a phrase deserves verification, and keeps the person in control of every consequential change.
What it does
Offroof accepts fictional or privacy-cleaned offer text by paste or browser-local .txt, .md, and simple plain-text .eml import. It detects deterministic verification signals, attaches each signal to its exact supporting excerpt, and separates:
what the message literally says; the limited inference a reviewer may draw; what Offroof cannot conclude; the next verification step.
Offroof never labels an offer as fraudulent or safe. It never opens a link or attachment, contacts an employer, sends money, or files a report. Instead, it creates an inspectable case record and a reversible verification checklist.
Why WebMCP
Offroof exposes the same visible case as six semantic, page-native tools through document.modelContext.registerTool(...):
get_case_summary — read a sanitized case snapshot and safe next actions. inspect_offer_signals — run browser-local deterministic inspection. build_verification_plan — create a visible checklist after explicit user consent. update_verification_step — update one current step with case/version guards. get_official_resources — read an allowlist of official Korean guidance. get_action_receipts — inspect filtered, privacy-safe activity receipts.
WebMCP is central to the product. The person and agent share the same visible state; read, analysis, and mutation operations are separated; mutations require on-page consent; stale case versions are rejected; and operational calls leave visible receipts without storing the original offer text or raw tool arguments. The manual interface still works when no WebMCP client is connected.
How we built it
Offroof is a static React, TypeScript, and Vite app. Signal inspection, privacy masking, file-intake validation, state transitions, WebMCP adapters, and receipts all run in the current browser tab. No backend, account, API key, or real personal data is required.
The six tools use bounded JSON schemas, enums, additionalProperties: false, stable error codes, conservative annotations, and compact structured results. Mutation tools validate both explicit consent and the latest case ID/version.
The app has three state-preserving views—Overview, Review offer, and Case record—plus a Korean/English switch that does not reset the active case.
Safety and trust boundaries
Offer text is treated as untrusted content, never as agent instruction. Files are read locally and never executed. HTML, multipart, binary, encoded, archive, PDF, Word, and executable inputs are rejected. Links and attachments are never opened automatically. Evidence is masked before it is returned to an agent. Offroof provides verification signals, not a fraud or malware verdict.
What we verified
On the deployed public build, a native WebMCP client discovered all six tools. Using only the fictional built-in sample, we verified the complete flow: six evidence-backed signals, a blocked mutation before consent, a six-step plan after consent, one checklist update, and a newest-first action receipt trail. The visual interface updated from the same domain state after every call.
The project also has 43 automated tests, a passing production build, and zero production dependency vulnerabilities.
Challenges
The hardest part was defining a truthful safety boundary rather than merely detecting keywords. A checklist mutation must not silently operate on stale state, untrusted offer text must never become agent instruction, and a read-only receipt query must not recursively create another receipt. We also made the manual and agent paths converge on the same domain transitions so the demo is not a separate mock.
What we learned
WebMCP works best when the webpage is already trustworthy for a person. Semantic tools can then expose the same bounded operations to an agent, with schemas, consent, state guards, visible effects, and receipts. The protocol does not replace product safety boundaries; it makes them machine-operable and auditable.
What's next
Future work could add an opt-in browser extension or approved mail-provider integration for pre-click mailbox review. A separate isolated service—potentially implemented in Python or Java—could inspect deliberately selected attachments by signature, hash, metadata, and safely extracted text. Those capabilities are intentionally outside this browser-only submission and would never silently open or execute content.
Try it
Live app: https://kjs844-art.github.io/offerproof-webmcp/
Public repository: https://github.com/kjs844-art/offerproof-webmcp
Built With
- css
- github
- html
- openai-codex
- react
- typescript
- vite
- webmcp