Package-G WebMCP

Inspiration: AI agents are increasingly capable of navigating interfaces, collecting information, and helping humans complete complex workflows. But in evidence-sensitive work, there is an important boundary: the agent helping with the process should not automatically become the authority that decides what is true.

That idea inspired Package-G WebMCP.

Package-G is a deterministic, browser-local evidence auditor. A human defines and confirms the audit semantics, while claims, evidence, provenance, gaps, findings, and results remain explicitly inspectable. ChatGPT can navigate and operate that workflow through WebMCP, but the authoritative verdict is produced by Package-G's deterministic auditor.

The core principle is simple: ChatGPT navigates. Package-G decides.

What it does: Package-G lets a user create or load an audit workspace containing claims, evidence, provenance, and an audit contract.

Through WebMCP, ChatGPT can then:

• summarize the current workspace;
• read the audit contract;
• list and inspect claims;
• list and inspect evidence;
• identify evidence gaps;
• request a deterministic audit;
• retrieve the authoritative result;
• explain the resulting decision chain.

The submitted application exposes exactly 10 WebMCP Site Tools.

The important part is what those tools cannot do. ChatGPT cannot use them to invent authoritative findings, change evidence truth, override a verdict, or turn a rejected audit into an accepted one. For the same frozen inputs, ruleset, and auditor runtime, Package-G is designed to produce the same semantic audit result independently of the agent operating it.

Why WebMCP

This is a workflow where structured interaction matters much more than having an AI read text from a page.

Without WebMCP, an agent has to infer application state from the visual interface and decide which buttons or text correspond to the user's intent. With WebMCP, Package-G exposes explicit, bounded operations with structured inputs and outputs. ChatGPT can understand the audit workspace as a tool-enabled application rather than approximating it from page content.

We tested this using the ChatGPT desktop app and its built-in browser. ChatGPT discovered all 10 Package-G Site Tools and successfully invoked all 10.

In our C09 demonstration scenario, Correct Evidence, Wrong Repository, ChatGPT requests the audit through WebMCP, while Package-G's deterministic Worker evaluates the evidence and returns:

"REJECT_WITH_REPAIR_REQUIRED"

ChatGPT can inspect and explain that result, but it cannot override it.

How we built it:

Package-G WebMCP is implemented as a browser-local TypeScript application using React and Vite.

The deterministic auditor runs in a fresh Dedicated Module Worker. Runtime identity, ruleset identity, and audit inputs are explicitly bound so reproducibility can be checked rather than assumed.

The application uses:

• WebMCP / document.modelContext for Site Tool registration;
• TypeBox schemas and Ajv standalone/AOT validation;
• Web Workers for deterministic audit execution;
• IndexedDB/Dexie for local persistence;
• Web Crypto for hashes and integrity checks;
• Vitest and fast-check for unit/property validation;
• Playwright for real-browser conformance testing;
• Netlify for the public production deployment.

Core V1 does not require a remote application backend, remote database, or OpenAI API key. The audit itself runs locally in the browser.

Challenges:

One of the most useful parts of the project was discovering problems that only appeared when the system left the local test environment.

Our first production pipeline revealed that a clean Netlify build did not reproduce the same finalized D11 verification artifact as our audited local release. We changed the release pipeline so that a production build validates a closed, cryptographically bound scenario corpus and fails transactionally instead of leaving stale release artifacts behind.

A later live-browser test exposed another issue: our strict production Content Security Policy blocked Ajv's runtime schema compilation because it relied on dynamic code generation.

Instead of weakening the CSP with unsafe-eval, we changed the validation architecture to compile the runtime validators ahead of time with Ajv standalone generation. We independently compared the new AOT validators against reference Ajv behavior across more than 15,000 validation cases with zero mismatches.

The final production application runs successfully with the strict CSP and without runtime "eval" or "Function" construction.

What we learned:

The biggest lesson was that WebMCP is not only about making websites easier for agents to operate. It can also be used to define authority boundaries between an agent and the application it operates.

We learned how important lifecycle-scoped tools, bounded schemas, deterministic execution, runtime identity, production CSP behavior, and real in-app ChatGPT discovery are when moving from a WebMCP prototype to something independently testable.

We also learned that browser-local deterministic systems and AI agents do not have to compete for authority. They can complement each other.

What's next:

Package-G can operate without an LLM, which opens an interesting next step: exposing the same deterministic audit core through human-only, agent-operated, and hybrid workflows.

WebMCP demonstrates that an AI agent can participate deeply in a high-integrity application without becoming its final source of truth.

Built With

• ajv
• dexie
• github
• html5
• netlify
• node.js
• react
• typebox
• typescript
• vite
• vitest
• webmcp
• zip.js