WebMCP Guardrail Labs

Prototype risky browser-agent actions with visible human approval and deterministic proof.

Comment

Inspiration

Giving an AI agent a structured web action is easy. Making a consequential action understandable, reviewable, and verifiable is harder. Teams exploring agentic commerce, deployment operations, or incident workflows need to see exactly what an agent intends to change before connecting it to production.

What it does

WebMCP Guardrail Labs is an open-source sandbox for designing that boundary. An agent can inspect page state, prepare a typed action, and explain the result through WebMCP. A consequential call stops at CONFIRMATION_REQUIRED; only the visible page can record the human decision. Deterministic code then rechecks the action and creates a local receipt.

The primary Promotion Regression Lab compares PROMO-20 v1, which starts at $120, with a proposed v2 starting at $100. Four boundary carts reveal exactly two changed customer outcomes: $100 and $119. Supporting labs apply the same pattern to a synthetic deployment rollback and a mock incident case.

The reusable interaction contract is: agent prepares, human decides, code verifies.

Why WebMCP

The page already knows its business operations, schemas, state, and safety checks. WebMCP exposes those semantics as page-scoped tools, so an agent does not have to infer them from visual layout or raw DOM interaction. The ordinary interface remains fully usable.

People and agents divide the work cleanly: the agent gathers state and prepares evidence; the person makes the consequential decision in context; deterministic code verifies the result. This makes sensitive browser-agent workflows clearer and more auditable without giving the agent hidden authority.

How we built it

Each selected lab registers strict imperative WebMCP tools with document.modelContext.registerTool(). Agent and visible-UI calls enter the same state machine in src/domain.mjs, so validation, ordering, stale-state handling, plan matching, redaction, idempotency, and receipt rules cannot drift between surfaces.

Module-private decision provenance prevents JSON arguments from manufacturing approval. The dependency-free Node server serves native HTML, CSS, and browser JavaScript. No application data is sent to an external model or API.

Key features

  • Four boundary carts expose two promotion regressions immediately.
  • Strict schemas, annotations, discovery, and execution through WebMCP.
  • Agent-supplied approval cannot commit consequential actions.
  • Deterministic verification precedes each idempotent local receipt.
  • Promotion, rollback, and incident labs share one four-stage interaction model.
  • The complete workflow remains available through the ordinary UI.
  • Evidence distinguishes verified Chrome runs from checks that were not run.

Testing

No account or credentials are required.

  1. Open the live app in ChatGPT's in-app browser or Chrome 149+ with WebMCP enabled.
  2. In Promotion, ask: "Inspect PROMO-20 and preview v2 with a $100 threshold. Tell me which carts change. Do not approve it."
  3. Confirm that $100 and $119 are marked as regressions and an agent approval attempt returns CONFIRMATION_REQUIRED.
  4. Use Approve and verify v2 on the visible page; confirm 4/4 assertions and receipt PROMO-20-v2-r2.
  5. Open ?id=D2 and ?id=B2 for the synthetic rollback and mock incident journeys.
  6. From a Node.js 20+ checkout, run npm test, npm run evaluate:chrome, and npm run evaluate.

The deterministic suite passes all 64 checks. Hosted Chrome journeys pass for E2-R, D2, and B2. Interactive ChatGPT and assistive-technology checks are honestly marked not run.

AI and Codex usage

OpenAI Codex assisted with official-source research, product scoping, implementation, accessibility review, tests, Chrome DevTools Protocol automation, Render packaging, evidence capture, and submission preparation under human review. The participant selected the concept, key product decisions, public deployment, and review checkpoints.

Links

Known limitations

This is a deterministic proof of concept, not production authorization infrastructure. It has no authentication, durable audit store, tenant isolation, rate limiting, validated DLP, real commerce/deployment/regulator integrations, user study, legal guidance, or production-security claim. All demonstrated data and effects are synthetic.

Built With

Share this project:

Updates

Submission history