Threshold

Threshold is one web page where several independent care organisations answer a person's AI assistant at the same time, and compose a single plan between them. The person tells their story once, to the assistant they already trust, and no organisation receives anything identifying until the person presses Send.

It is eleven at night. A carer has just been told she needs surgery on Thursday morning. Her mother has dementia and cannot be left alone. Arranging cover means three things at once: a respite bed, a wheelchair-accessible journey to it, and someone at the house until the transport arrives. Three organisations. Three phone calls that cannot be made at this hour, and each one depends on the answers to the other two.

Her assistant asks Threshold once. Three organisations answer at the same moment. And the obvious combination comes back infeasible on exactly one link:

arrival_before_admission    required 06:40    offered 07:10    go back to: Northgate Accessible Transport

The bed admits until 06:40. The earliest that van arrives is 07:10. Neither organisation can see the other, so neither can know. Threshold does. It names the failing link, names the one organisation to return to, a different van closes the plan, and the carer keeps a printable copy. That failing link is the whole product.

The problem is fragmentation, and it is expensive

£24.1 billion of income-related support goes unclaimed in Great Britain every year. 7.5 million people miss at least one benefit, an average of £3,203 each. (Policy in Practice, 2025/26.)

Complexity and fragmentation are two of the named causes. "No Wrong Door" has been United States federal policy for two decades: whichever door a person knocks on first should get them to the right help, with agencies keeping their own services while sharing one way in. It has never been architecture, because it asks every agency to integrate with a central system, and they never do. WebMCP's exposedTo and allow="tools" make it architecture. The page is the way in. The agencies stay exactly where they are.

Why this is a strong fit for WebMCP

Every WebMCP demo so far is one company helping one customer buy one thing. Threshold is several organisations, on separate origins, with separate databases, serving one person who never had to repeat themselves, with the person's private context staying inside their own assistant the entire time. The concept exists only because WebMCP exists. A browser-side broker that discovers and calls tools across origins is the one thing that turns three unconnected websites into one coordinated answer, with no shared backend and no data-sharing agreement between them.

What people and their agents can do together that was impossible before

Ask whether several offers, held at organisations that cannot see each other, satisfy each other.

A federated search returns three independent answers, and one vendor with three product lines could serve that just as well. Composition is a different question. check_plan takes offers from three origins and asks whether the transport arrives before the bed stops admitting, whether there is a hoist at both ends of the journey, whether overnight cover lasts until collection. It returns the failing link and the organisation to renegotiate with. There is no non-federated way to build that, because the parts live at parties who will never share a database.

Holding a scarce bed at machine speed

When assistants act at machine speed against scarce humanitarian resources, two assistants will send two people to the same last bed. Threshold treats a hold as a first-class thing, with a timer and a release. It leases each part of a plan, one organisation at a time, scarcest first, and the organisation itself stays the authority on whether it holds. There is no shared transaction across these independent websites, so if any leg is refused, every lease already taken is released before the call returns. Nothing is ever left booked against a plan that cannot happen.

Safety, by construction

A malicious listing aimed at a person in crisis is a real risk. Threshold never carries provider-authored text into the assistant's context. Every field an organisation can return is an enum, a boolean, an integer, or a string under a pattern. An instruction to a model does not fit inside ^[A-Z]{1,3}[0-9]{1,4}$, and it does not fit inside an enum. A test walks every provider contract and proves there is no free-text field for an instruction to hide in. Every capability claim is labelled by its source.

A better experience for the person

The person does one thing: she reads a plain-language panel and presses Send.

The consent gate names the one organisation that will receive the referral, the exact four fields it will receive, and how long they may keep them. A host assistant can already ask for confirmation. What a page can do that a host dialog cannot is show the person the payload and let her change it, correcting the phone number before it leaves. make_referral returns a Promise that resolves on that press. Until then, nothing identifying has crossed an origin, and a boundary log on the page shows exactly what has, field names only.

How I implemented WebMCP

• Each organisation publishes four tools with registerTool and exposedTo, scoped to Threshold's origin alone. Never a wildcard.
• The hub embeds each provider in an iframe that delegates the tools permission with allow="tools", discovers their tools with getTools({ fromOrigins }), and calls them with executeTool, passing arguments as a JSON string and treating a null return (a navigation) as a contract violation rather than an empty success.
• The hub exposes nine tools to the person's assistant, and the tool surface is a state machine. place_plan_holds does not exist until check_plan returns feasible, and make_referral does not exist until a lease does. An assistant cannot call a step out of order, because the step is not in its list. ontoolchange is how the hub learns a provider has withdrawn.
• Every provider result passes a typed firewall: parse, validate against a strict JSON Schema, project to the hub's own shape. A rejected payload never reaches a return value, a log line, or an error message.

176 unit and integration tests, 15 browser tests, real WebMCP federation verified in Chrome, and again as four containers on four origins. If a browser cannot do cross-origin WebMCP, the same providers on the same origins are reached over a typed postMessage protocol with the same schemas, the same firewall, the same leases and the same gate, and the page states in words which path it used.

Threshold. Several organisations. One plan. One page.

Built With

• css
• mcp
• typescript