WebMCP-QCG: Quantum Call Gate

Inspiration

Quantum developers already have capable frameworks, simulators and hardware services. The risky moment often comes before execution: an AI agent can prepare a technically valid-looking call before the human has verified the artifact, target evidence, limits, scientific intent or authority to spend.

I built WebMCP-QCG to make that moment inspectable. Its promise is simple: review before you run.

What it does

WebMCP-QCG is a browser-native, human-in-the-loop quantum preflight workbench.

A human imports a local Q# artifact. QCG keeps the source in session memory, computes a SHA-256 digest over the exact bytes, compiles it locally with the pinned Q# WebAssembly runtime and freezes a dated target-profile snapshot. Its deterministic policy returns exactly one recommendation:

reuse_result reject recompile simulate_first ready_for_external_execution

The agent can use four progressive WebMCP tools:

inspect_quantum_experiment evaluate_quantum_call run_bounded_qsharp_simulation export_quantum_evidence_report

The first two appear only after a human-loaded artifact is ready. A bounded simulation tool appears only after a valid simulate_first recommendation and visible human acceptance. Its one-use consent is consumed after invocation. QCG exports a JSON or Markdown evidence receipt binding the artifact, target snapshot, recommendation, human choice and measured effects.

The MVP never submits a provider job, uses a provider credential or calls a QPU. Its QPU counter remains zero.

Live application: https://qcg.securedme.ca/ Source and reproducible evidence: https://github.com/SeCuReDmE-main-dev/webmcp-hackathon-2026

How I built it

The application uses React, TypeScript and Vite. Strict Zod contracts reject unknown properties and bound artifact size, shots, qubits and timeouts. qsharp-lang@1.31.0 runs inside a Web Worker so compilation and the published Bell simulation remain local and cancellable. Raw Q# stays out of WebMCP responses and IndexedDB; only evidence receipts persist locally.

All human buttons and WebMCP tools call the same service layer. Tools are registered through document.modelContext with AbortSignal cleanup. The retained HTTPS origin serves the required WebMCP and security headers, the Worker and the pinned WebAssembly asset.

Challenges I ran into

The hardest design problem was separating three different things: an agent recommendation, a human authorization and an actual effect. Treating them as one state would make a convenient demo and a weak control system.

The first live smoke run also exposed a real browser race: the inspection tool could be discovered before the initial WASM analysis finished. I changed the registration lifecycle so artifact tools stay absent until the manifest exists, then repeated the full test on the public origin.

A second challenge was restraint. A multi-provider quantum router is an attractive future direction, but the hackathon proof needed one narrow, falsifiable vertical slice.

Accomplishments I am proud of

A real Q# file produces a byte-exact manifest and zero-diagnostic compiler evidence. Five falsifiable requests exercise all five decisions. The human can accept, defer or override with visible provenance. One accepted Bell simulation returned 64 correlated shots with the Bell invariant passing. The simulation tool disappeared after its one-use consent was consumed. The evidence export contained no raw Q#, local path, secret or provider error. Vitest passes 17/17 tests, including exact-versus-near reuse and false-ready regressions. Official WebMCP smoke evaluation passes 2/2 on the retained HTTPS origin. The live trace records one local simulation and zero QPU submissions.

What I learned

WebMCP adds value when the agent needs a compact capability that is absent from the visible DOM and shares the same state transitions as the human interface. Progressive registration is part of the product contract, not decorative plumbing.

I also learned that a refusal, reuse decision or request for better evidence can be a useful outcome. Quantum tooling does not become safer by executing more calls; it becomes clearer when every proposed call has a reason, an authority boundary and a receipt.

What's next

I will test the frozen cases with quantum developers, measure false-ready decisions, refresh target-profile evidence and refine the visual workbench. Future adapters may normalize evidence from additional ecosystems while preserving their native semantics. Provider submission and paid execution remain outside this MVP and would require a separate authorization design.

Built With

• indexeddb
• q#
• react
• typescript
• vite
• web-workers
• webassembly
• webmcp
• zod