Repro Ledger

• 

  RL-101 awaiting human review after the agent completed evidence-bound validation.

• 

  The redesigned review gate binds four evidence signals to the exact report revision awaiting human approval.

why this exists

Vulnerability reports often fail at the boring boundary between evidence and claims. A reproduction may be real while the impact is unsupported, the asset is out of scope, or the final report quietly overstates what the evidence proves.

Repro Ledger makes that boundary visible. It is an editorial evidence desk where an agent can inspect synthetic vulnerability evidence, draft a structured report, validate every claim category, and request review. A person still controls approval and export.

Everything in the demo is fictional. Northstar Cloud, its .invalid assets, the cases, requests, responses, and program rules are synthetic.

what people and agents can do together

The seeded workspace contains three deliberately different cases:

• RL-101 is in scope and has evidence for scope, reproduction, impact, and a negative control.
• RL-102 is in scope but lacks impact and negative-control proof, so review remains blocked.
• RL-103 is reproducible but explicitly out of scope, so review remains blocked.

An agent can list the cases, inspect the program rules and evidence, write a report draft, run deterministic validation, and request human review. Those edits appear in the same workspace the person is viewing, without a reload.

The person can edit the draft, approve the exact revision, and download the approved report as Markdown. Approval and export are intentionally not agent tools. Any later edit returns the report to draft and invalidates the previous approval.

why WebMCP is the right interface

DOM automation would make an agent infer the task from labels, layout, and click targets. That is brittle, and it blurs the permission boundary between drafting and approval.

Repro Ledger exposes six imperative WebMCP tools with strict inputs: list_cases, get_case_context, get_evidence, update_report_draft, validate_report, and request_human_review. Read operations are annotated as read only. All tool results are marked as untrusted content. Unknown IDs, cross-case evidence IDs, malformed inputs, and invalid transitions fail with actionable errors.

The WebMCP surface is deliberately narrower than the interface. The agent gets the actions it needs to assemble an evidence-backed report, but it cannot approve, export, reset fixtures, or mutate program scope. Unsupported browsers still get the complete manual workflow.

how it was built

The app uses React 19, TypeScript, Vite, Tailwind/Kumo, Zod Mini, Vitest, Testing Library, and Cloudflare Workers.

React state and a versioned localStorage record back both the human UI and the WebMCP tools. Canonical program rules, scope verdicts, evidence text, and evidence coverage signals are compiled fixtures rather than trusted browser storage. A shared reducer keeps human and agent edits on the same transition path.

Validation is deterministic. A reviewable report needs a bounded title, summary, impact, severity, three to ten reproduction steps, an in-scope verdict, and linked evidence covering scope, reproduction, impact, and negative control. Approval is a session-only grant bound to the current report revision. Markdown export escapes untrusted structure before download.

challenges and lessons

The hard part was not registering tools. It was keeping the trust boundary honest when local state, evidence content, and agent output are all potentially untrusted.

That led to strict persisted-state parsing, cross-case ownership checks, revision-bound approval, cleanup for partial tool-registration failures, bounded schemas, export escaping, and tests for forged approval state and invalid transitions.

The main lesson is that WebMCP works best as a small command surface, not a second copy of the UI. The site should define the task model, validation rules, and permissions. The agent should operate inside those rules, and the person should keep the decisions that require judgment or accountability.

try it

Live demo: https://repro-ledger-webmcp.repro-ledger.workers.dev/

Source: https://github.com/StressTestor/repro-ledger

Demo prompt:

Review the open cases in Repro Ledger. Select the strongest in-scope finding with sufficient evidence, produce a concise evidence-backed report, validate it, and request human review. Do not approve or export it.

Built With

• cloudflare
• react
• tailwind
• testing-library
• typescript
• vite
• vitest
• webmcp
• zod