WebMcp.AI

Inspiration AI agents can understand websites, but they still interact with most of them like humans: reading pages, interpreting interfaces, finding controls, and simulating clicks. These workflows are slow, fragile, and often fail when a website’s layout changes. WebMCP offers a better approach. Websites can expose structured tools that agents discover and call directly while keeping people involved in the same visible experience. That inspired us to build WebMCP.ai: a tool that analyzes any public website and identifies the most useful opportunities for making it agent-ready with WebMCP. What it does Users provide a public website URL, and WebMCP.ai researches the website, understands its business and primary workflows, and generates an evidence-backed WebMCP opportunity report. Each report includes:

An overall agent-readiness score
Scores for discoverability, structured data, agent actions, automation, and MCP potential
Ranked WebMCP tool opportunities
Proposed tool names, descriptions, and input/output schemas
User value, business value, implementation difficulty, and safety ratings
Authentication, authorization, validation, confirmation, and audit safeguards
Research sources and clearly identified limitations
A production-ready implementation prompt for coding agents Users can filter and compare opportunities, select the tools they want to build, and export the report or implementation prompt. WebMCP.ai is itself WebMCP-enabled. It exposes three browser-native tools:
analyze_website analyzes a public website and updates the visible report.
get_opportunity_report returns the complete current report.
select_tools_for_plan selects recommendations and creates a tailored implementation plan. This means an agent can operate WebMCP.ai directly without typing into the URL field or clicking the Analyze button. The agent and user remain in the same interface and share the same application state. How we built it We built WebMCP.ai as a full-stack Next.js application using React and TypeScript. The analysis pipeline first validates the submitted URL and rejects embedded credentials, unsupported protocols, private networks, local addresses, and unsafe redirect destinations. It then performs a bounded crawl of relevant public pages using Cheerio. The extracted content is explicitly marked as untrusted data before being sent to an OpenAI-compatible Responses API. The model researches the website’s business, workflows, public APIs, competitors, and relevant MCP precedents. Its response must match a strict Zod schema before the application accepts it. Opportunity scores are calculated deterministically rather than relying entirely on model judgment. The application then builds a structured implementation prompt containing tool schemas, safeguards, engineering requirements, testing expectations, and acceptance criteria. The WebMCP integration uses the imperative document.modelContext.registerTool API. Tools are registered once with AbortSignal cleanup and reuse the same logic and React state as the visible interface. The application is deployed on Vercel, while the source code and project documentation are hosted publicly on GitHub. Reports remain in browser memory, so no database is currently required. Challenges we ran into One major challenge was working with websites that block automated access, require authentication, or render most useful content through client-side JavaScript. We addressed this by reporting incomplete access honestly and grounding every recommendation in the evidence that was actually available. Analysis requests can also take time because they combine website extraction, research, structured generation, and validation. We introduced bounded timeouts and a fallback analysis path when enriched web research takes too long. Another challenge involved WebMCP lifecycle management inside React. Initially, tool registration could be recreated when the URL or report state changed. We stabilized the callbacks and used references to the latest report so agents retain valid tool handles while the interface updates. Security was equally important. A tool that accepts arbitrary URLs can create server-side request-forgery risks, while crawled content can contain prompt-injection attempts. We added DNS and redirect validation, private-network blocking, content-size limits, bounded crawling, strict schemas, and explicit untrusted-content boundaries. Finally, we had to ensure agents selected the WebMCP tool instead of falling back to browser interaction. Accurate read-only annotations, stable registration, and direct tool descriptions made that behavior reliable. Accomplishments that we’re proud of We are proud that WebMCP.ai does more than generate generic tool ideas. It produces ranked, evidence-backed opportunities connected to real workflows, business value, technical feasibility, and safety requirements. We are especially proud that the application demonstrates the experience it recommends. Agents can call WebMCP tools directly, update the same interface the user sees, retrieve the resulting report, and collaboratively choose an implementation plan. Other accomplishments include:
Strictly validated structured model output
Deterministic opportunity scoring
Transparent evidence and limitations
Production-oriented implementation prompts
SSRF and prompt-injection defenses
Stable WebMCP registration and shared UI state
Automated unit, integration, lint, type, build, and end-to-end checks
A responsive interface with report and prompt exports What we learned We learned that effective WebMCP tools should not simply reproduce button clicks. The best tools expose stable business capabilities with clear inputs, structured results, and well-defined safety boundaries. Tool metadata also matters more than expected. Names, descriptions, schemas, annotations, and lifecycle behavior determine whether an agent can confidently discover and use a tool. We also learned that agent readiness is not purely a technical score. Authentication, data availability, business value, user trust, implementation effort, and human confirmation all influence whether a workflow should become a tool. Most importantly, WebMCP works best as a collaboration layer. It does not need to replace the interface. It can connect agents to the application’s real capabilities while keeping the user informed and in control. What’s next for WebMCP.ai Next, we want to add:
Saved and shareable reports with explicit retention controls
Repeatable WebMCP evaluations that measure tool-selection accuracy
Before-and-after readiness comparisons
Organization workspaces and collaborative reviews
Direct export to GitHub issues and engineering backlogs
Automated validation of implemented WebMCP schemas
Historical monitoring as websites improve their agent readiness
Additional analysis of authenticated workflows through approved integrations Our long-term goal is for WebMCP.ai to become the bridge between human-first websites and agent-native experiences: helping teams decide what to expose, why it matters, how to build it safely, and whether it actually improves the experience.