Watch Dog

Inspiration

I knew that I wanted to promote something that would help others navigate the challenges with today's internet. I found that in building a tool that could not only scan for malicious links, but also give the community the ability to work together to make the internet a better place to browse.

What it does

Watch Dog is an evidence-first URL risk inspector with two scan modes:

1. Paste Scan accepts a URL or pasted HTML. URL fetching is bounded and SSRF-aware, while pasted HTML is parsed without executing scripts or loading embedded resources.
2. Live Page Scan uses WebMCP to inspect the links currently rendered on Watch Dog’s own reference page. Because extraction happens when the tool is invoked, it can detect links added after the page originally loaded.

Instead of declaring a link “safe,” Watch Dog separates:

• the risk classification;
• the analysis state;
• confidence in the available evidence;
• supporting and contradicting evidence;
• provider status and freshness; and
• limitations or missing information.

How we built it

Watch Dog is a TypeScript application deployed on Cloudflare Workers. We used Cloudflare Assets and Durable Objects for the application and session boundaries, with server-side authentication represented by a signed, short-lived, secure cookie.

I implemented WebMCP using the browser’s native experimental document.modelContext interface. Playwright, Wrangler, and Node’s test runner were used for automated security, protocol, browser, and regression testing.

I used Claude Code/Fable 5.1 to generate the plan, Codex/Sol for execution, and Luna for review/QA.

Challenges we ran into

WebMCP is an emerging browser capability. I had to validate real native tool discovery and invocation in a supported Chromium build instead of relying only on mocks or simulated agent interactions.

Accomplishments that we're proud of

I wasn't aware of this hackathon until the Discord Office Hours on 8/31, and wanted to see what I could cook up in just a few days time. The 12 hour extension was well received!

What we learned

I learned how to use new tools in WebMCP and Cloudflare.

What's next for Watch Dog

Next, I want to add more permitted threat-intelligence providers, improve accessibility and evidence visualization, and introduce an optional human-confirmed reporting workflow with sanitized, quarantined records.

A future browser extension could support scanning unrelated active tabs, but only with explicit host permissions and clear user consent. I also plan to add a Watch Dog-mediated warning interstitial that shows the canonical destination and keeps the final navigation decision with the user.

Longer term, Watch Dog can become a reusable trust layer for browsers and agents: deterministic security analysis underneath, structured WebMCP evidence in the middle, and informed human control at the top.

Built With

• chromium
• claude
• cloudflare
• codex
• github
• playwright
• webmcp