Web2MCP

• 

  chrome extension

• 

  agent use case

Inspiration

WebMCP is a beautiful idea — websites exposing their functionality to AI agents as callable tools. But it has a chicken-and-egg problem: it only works if the website adds it. Almost no site has, and most never will. Meanwhile, every one of those sites is already making perfectly good API calls in your browser, right now, as you use it.

So we asked: what if the agent didn't need the site's cooperation at all? What if you could just browse a site normally, and have its APIs turn into agent-callable tools automatically — learned from the traffic the site already produces?

What it does

Web2MCP is a browser extension that records the API calls a website makes while you browse and injects them as native WebMCP tools an in-browser AI agent can call.

• Records every JSON API a page calls — its own backend and third-party APIs — while filtering out static assets and trackers.
• Aggregates requests into endpoint templates (/users/123 → /users/{id}), inferring JSON Schemas and required fields from what it observes.
• Injects each endpoint as a WebMCP tool via document.modelContext. Calls replay from the page's own context, so cookies and captured auth headers just work.
• Pools by website, so subdomains and pages share one tool set; shows a live tool count on the toolbar badge; lists tools in a popup (including the site's own first-party WebMCP tools); and lets you disable injection per site.

No config, no schemas to write, no per-endpoint wiring.

How we built it

• WXT + TypeScript + React for a Manifest V3 extension.
• A MAIN-world content script patches window.fetch and XMLHttpRequest to observe traffic and to register/replay tools; an ISOLATED-world bridge relays messages to a background service worker that does all aggregation, schema inference, and local storage.
• Injection uses the browser's native WebMCP registerTool API; replay uses the saved native fetch so tool calls never re-trigger recording.
• The "brain" — URL templating, schema inference, tool naming, aggregation, filtering — is pure, dependency-free modules covered by vitest (60+ tests).
• A landing page and privacy policy shipped on Cloudflare Pages.

Challenges we ran into

We tested on real sites, and the real world fought back — which turned out to be the most valuable part.

• Anti-automation is everywhere. We hit three distinct walls: Linear injects auth in a service worker below the page's fetch (invisible to us → 401); X and GitHub use one-time nonces (x-client-transaction-id, x-fetch-nonce) that expire after a single use (→ 422); Xiaohongshu signs the request body client-side (x-s), so changing any argument breaks the signature (→ 406). We had to map — and honestly document — exactly where record-and-replay can and can't work.
• Agents under-supply parameters. An LLM calling a search tool would omit sortBy or invent a sessionId, getting empty results. The fix: surface the real recorded request body as an example and merge the agent's fields over it, filling in what it left out.
• The little things: a signal destructuring crash that broke every tool call, extension-context invalidation after reloads, JSON responses truncated mid-object, and getting WebMCP itself enabled in a custom Chromium browser (via a Finch/variations study).

Accomplishments that we're proud of

• It's genuinely zero-config. Browse a site and its tools appear — with a badge counting them and a popup listing them.
• It works end-to-end on real sites. We watched an agent successfully call a live government job-search API and read GitHub data through tools Web2MCP recorded — cross-domain, authenticated, no keys.
• It's honest. We built the "Works great / Can't replay" boundary into the product and the site instead of overselling.
• It's smart about the data it already has — auto-filling session tokens and merging partial request bodies from real recordings so agents stop failing on missing fields.
• Users stay in control — per-site disable, one-click clear, everything stored locally and nothing leaves the device.

What we learned

• The real boundary of record-and-replay: it works whenever the request's content isn't itself part of authentication — cookie-authed apps, static tokens, read endpoints, your own products. It can't beat mechanisms designed to stop exactly this (SW-injected auth, one-time tokens, body signatures). Knowing that boundary precisely is more useful than pretending it doesn't exist.
• Agents need examples, not just schemas. A JSON Schema tells a model the shape; a real recorded request tells it what actually works.
• Honesty is a feature. Being upfront about limits made the product more trustworthy, not less.

What's next for Web2MCP

• Chrome Web Store release and broader reach as WebMCP ships in stable browsers.
• Smarter body handling — deep merge, and richer per-parameter examples.
• First-party passthrough — surface and manage a site's own WebMCP tools alongside recorded ones.
• An adapter path for hardened sites — optionally invoke the site's own signing/request code (or fall back to driving the real UI) for signature- and nonce-protected APIs.
• Sharing & sync — export a site's recorded tool set so a team can reuse it.

Built With

• cloudflare