SiftIO

Inspiration

Everyone has a file they'd like to ask questions about and will never upload. A bank export. A health record. Ten years of app history. The moment an AI is involved the implicit deal is "send us your data" — so most people just don't. That deal exists because of where the code runs, not anything fundamental. WebMCP changes where the code runs.

What it does

CSV and JSON exports load into DuckDB compiled to WebAssembly, running inside the tab. The agent writes the query, SiftIO runs it locally, and only the answer comes back, with an audit panel showing the number of rows held locally · and the number of rows seen by the agent.

How we built it

Angular 21 zoneless, DuckDB-wasm. Seven always-on tools plus two generated per dataset, whose input schema is built from that file's real columns. Registration is reactive; an effect watches the vault signal, so nothing calls registerTool from the UI.

Challenges we ran into

• registerFileBuffer detaches the ArrayBuffer — nothing survived a reload.
• Numbers wrong three ways — BigInt throws, Number() corrupts above 2⁵³, sum() returns Decimal128 limbs as text.
• A chart that was never drawn — hidden canvas measured at zero.

Accomplishments that we're proud of

• An agent really did use it and ChatGPT found the tools on the deployed site.
• A tool built for a file that didn't exist a moment ago.
• Trust you can check.
• Zero backend.

What we learned

I learned that WebMCP is a great tool, and it will change the way we interact with web apps. Learning such a tool is beneficial for building a futuristic AI Agent-friendly app without sacrificing security.

What's next for SiftIO

• Real tool removal when Chrome ships unregisterTool.
• Shareable views without shareable data.
• An exportable audit.
• Importers for Apple Health XML, Google Takeout, bank dialects.

Built With

• angular.js
• apache-arrow
• chart.js
• cloudflare-workers
• duckdb
• indexeddb
• javascript
• local-first
• sql
• typescript
• webassembly
• webmcp
• wrangler