Atlas / MCP servers / webmcp-org / @mcp-b

@mcp-bBLOCK

Name: @mcp-b
Author: webmcp-org

mcp/webmcp-org/npm-packages

MCP server by webmcp-org · Audited 2026-10-12

⚑ Report / re-scan Source ↗

NPM packages for MCP-B: Transport layers, React hooks, and browser tools for the Model Context Protocol

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

200 186r · 13w · 4d

Transport

stdio

License

MIT

Stars

104

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Polyfill and MCP bridge for the [Web Model Context API](https://webmachinelearning.github.io/webmcp/) (`document.modelContext`)

The Web Standard

The Web Model Context API is a W3C Community Group draft spec. It makes every browser tab a tool source — web pages register tools that AI agents can discover and call:

document.modelContext
├── .registerTool(tool, { signal })  Register a tool for AI agents
├── .getTools()                      Dis

Read from source at commit 5eb2f4276a63OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add webmcp-types --env SENTRY_AUTH_TOKEN=${SENTRY_AUTH_TOKEN} -- npx -y @mcp-b/[email protected]

claude-desktop

{
  "mcpServers": {
    "webmcp-types": {
      "command": "npx",
      "args": [
        "-y",
        "@mcp-b/[email protected]"
      ],
      "env": {
        "SENTRY_AUTH_TOKEN": "${SENTRY_AUTH_TOKEN}"
      }
    }
  }
}

Exposed tools (200)

186 read · 13 write · 4 destructive. Blast radius: 4 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`a_tool`	read	a_tool
`aborted_publication`	read	Aborts while cloning its output schema
`accepted`	read	Accepted asynchronously
`action`	read	v1
`added_later`	read
`after`	read	Updated tool
`aliased`	read	Forwarded upstream inference
`already_cancelled`	write	Does not run
`always_fail`	read	Throw a runtime error every time it is invoked.
`annotated`	read	Has annotations
`annotated_tool`	read	A tool with annotations
`another_tool`	read	Another tool
`array_input_tool`	read	Accepts a WebMCP array input
`async`	read	Async tool
`async_rejected_native_tool`	read	Native registration rejects asynchronously
`bad_ann_tool`	read	Has bad annotations
`batch_tool`	read	Batch test
`before`	read	Initial tool
`big_response`	read	Returns large data
`blocked_calculate`	read	Blocks the iframe registration
`boom`	read	Throws
`browser_close`	read
`browser_committed_execute`	write	Uses only committed closures
`browser_connect`	read
`browser_dependency`	read	Uses explicit deps
`browser_greet`	read	Greets a person
`browser_invalid_output`	read	Returns invalid structured output
`browser_latest_execute`	write	Uses the latest closure
`browser_layout_execute`	write	Publishes at commit
`browser_navigate`	read
`browser_post_unmount`	write	Settles after unmount
`browser_raw_json`	read	Returns raw JSON
`browser_response`	read	Returns an MCP response
`browser_screenshot`	read
`browser_standard_schema`	read	Uses Standard JSON Schema
`browser_total`	read	Adds two numbers
`browser_void`	read	Returns nothing
`cached_schema`	read	Keeps schema preparation stable
`cached_tool`	read
`calc_add`	write	Add two numbers
`calc_multiply`	read	Multiply two numbers
`calculate`	read	Adds two numbers after an optional delay
`cancel_execution`	read	Handles cancellation
`cancellable`	read	Reads the cancellation signal
`cancelled_execution_tool`	read	Waits for cancellation
`circular_schema`	read	Reports unserializable schemas
`close_race_tool`	read	Closes while registration is pending
`closed`	read	Closed with its server
`code-review`	read	Review code for best practices
`complex_tool`	read	Complex schema
`counter_decrement`	read	Decrement the counter by a specified amount
`counter_get`	read	Get the current counter value
`counter_increment`	read	Increment the counter by a specified amount
`counter_reset`	destructive	Reset the counter to zero. This action cannot be undone.
`decrementCounter`	read	Decrement the counter by 1
`destructured_register_tool`	read	Registered via destructured method
`disabled_tool`	read	A conditionally registered tool
`dom_extract_content`	read
`dom_extract_interactive`	read
`dom_extract_region`	read
`dom_extract_structure`	read
`doubleCounter`	read	Double the counter value
`dup`	read	Frame tool
`duplicate_owner`	read	First owner
`dynamic`	read	Dynamically registered tool
`dynamic-summary`	read	A dynamically registered prompt for summarization
`e2e_guard_tool`	read	Verifies single invocation
`echo`	read	Echo a string value back to the caller.
`empty_description_tool`	read
`evolving_tool`	read	Evolves
`execution_failure`	read	Reports execution failures
`extended`	read	Extended
`extended_hint`	read	Extended
`extension_child_script`	read	Echo a value from a same-origin child document.
`extension_dynamic`	read	A dynamically registered extension fixture tool.
`extension_echo`	read	Echo a value from the extension E2E fixture.
`extension_fail`	read	Fail so the extension can verify MCP error propagation.
`extension_set_dynamic`	destructive	Register or remove the dynamic extension fixture tool.
`extra_tool`	read	Extra
`fail`	read	Fail
`failure`	read	Throws
`frame_only`	read	Frame only
`framed_tool`	read	Registered in a frame without allow=
`from_frame`	read	Registered by a child frame
`full_tool`	read	Fully specified
`getCounter`	read	Get the current counter value
`get_status`	read	Returns app status
`get_user_profile`	read	Read user profile
`good_tool`	read	Valid
`greet`	read	Greet someone
`greeting`	read	A simple greeting prompt
`halveCounter`	read	Halve the counter value
`help`	read	Get help with using the application
`hidden`	read	Not readable
`iframe_echo`	read	Echo tool registered in iframe via registerTool (Bucket A)
`iframe_timestamp`	read	Timestamp tool registered in iframe via registerTool (Bucket B)
`incrementCounter`	read	Increment the counter by 1
`initial`	read
`input_no_type_tool`	read	Tool with input schema missing root type
`invalid_summary`	read	Invalid summary
`invalid_wrapped_summary`	read	Invalid wrapped summary
`late`	read	Registered after the relay connected
`lookup`	read	Look up an item
`mcp_agent_cancellation`	read	Preserves cancellation through error formatting
`mcp_agent_failure`	read	Preserves agent and local error contracts
`mcp_transformed`	read	Adds a numeric count to a limit
`mcp_validation_failure`	read	Formats invalid input for agents
`metadata_updates`	read	Updates metadata
`missing_execute_tool`	write	Missing execute callback
`modern_tool`	read
`multi_round`	read	Requires another input round
`my_tool`	read	A tool
`native_abort_rejected_tool`	read	Native registration rejects on cleanup abort
`native_cancelled`	read	Native cancellation
`native_close_race_tool`	read	Native registration closes the wrapper
`native_core`	read	Native WebMCP core
`native_event_tool`	read	Added after initialization
`native_options`	read	Forwards options
`native_shape_tool`	read	Native shape tool
`native_tool`	read	Conflicts with the browser registration
`native_void`	read	Returns nothing
`no_args_tool`	read	Tool with no arguments
`not_allowed`	read	Denied by the platform
`notification_tool`	read	Notification test
`object_output_without_root_type_tool`	read	Returns object structured content with a rootless schema
`old`	read	Old snapshot
`open_issue`	read	v1
`open_tool`	read	No allowlist
`original_tool`	read
`output_no_type_tool`	read	Tool with output schema missing root type
`parent_greet`	read	Greeting tool registered in parent via registerTool (Bucket A)
`parent_only`	read	Parent tool
`parent_time`	read	Time tool registered in parent via registerTool (Bucket B)
`pending_abort_tool`	read	Aborted before registration settles
`posts_like`	write	Like a post by ID. Increments the like count.
`posts_search`	read	Search posts by keyword
`pre_registered_tool`	read	registered before wrapper init
`preaborted_tool`	read	Never registers
`primitive_output_tool`	read	Returns primitive structured content in the browser surface
`probe`	read	Probes cross-origin registration
`promoted_tool`	read	Tool after promotion
`receiver`	read	Captures its receiver
`remote_close_tool`	read
`render_execution`	read	Tracks pending work
`render_metadata`	read	Revision ${revision}
`render_reset`	destructive	Resets state
`render_stable_tool`	read	Uses the latest committed callback
`resetCounter`	destructive	Reset the counter to 0
`restored_native_tool`	read	Original wrapper registration
`restricted_tool`	read	Only for the named embedder
`result`	read	Returns a value
`review_code`	read	Review code for best practices and potential issues
`runtime`	read	Runtime schema
`same_batch_calls`	read	Combines completion updates
`say_hello`	read	Returns a hello message
`search`	read	Search items
`search_docs`	read	Search docs
`search_summary`	read	Search with summary
`shared`	read	child
`signal_only_native_tool`	read	Native signal cleanup tool
`slow`	read	Wait until aborted
`slow_tool`	read	Never responds
`ssr`	read	Server rendering
`ssr_extended`	read	Extended server rendering
`stable`	read
`stable_connection`	read
`stable_tool`	read
`standard`	read	Standard tool
`standard_schema`	read	Uses a validator
`standard_schema_native_mirror`	read	Mirrors converted schema metadata
`state_machine`	read	Manage a state machine
`still_callable`	read
`strict_mode_tool`	read
`structured`	read	Returns structured content
`structured_counter`	read	Get counter value with structured output
`subject`	read	Subject to summarize
`subscribed_recovery`	read
`sum`	write	Add two numbers.
`summarize`	read	Summarize a piece of text
`sync`	write	Sync tool
`test_context`	read	Current value
`timer`	write	Start/stop/check timer
`timer_control`	write	Control a timer (start/stop/check)
`todo_add`	write	Add a new todo item
`todo_complete`	read	Mark a todo as complete
`todo_list`	read	List all todos
`tool_a`	read	From A
`tool_b`	read	From B
`tool_c`	read	C
`undefined`	read	Returns no JSON value
`undefined_schema`	read	Requires serializable metadata
`unserializable_result`	read	Returns non-JSON
`unsupported`	read	No API
`untyped`	read	Input schema without a type
`upstream_core_smoke`	read	Exercises object-input execution from the upstream WebMCP polyfill
`upstream_execution`	read	Runs through the official polyfill
`validation_abort_tool`	read	Aborted while validating origins
`void_result`	read	Returns nothing
`wait`	read	Runs until aborted
`webmcp_input_required`	read	Attempts an unsupported multi-round WebMCP flow

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: none-observed
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (22)

HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427

.agents/skills/release/SKILL.md:103

the user's approved interactive flow; do not read, print, or shell-evaluate `.env` files.

Why it matters. asks the agent to read credentials

HIGHPrompt injection · prompt.override · CWE-94, CWE-1427

apps/documentation-website/start-here/metadata.mdx:101

<Note>MCP support in ChatGPT requires a paid plan with Developer Mode enabled.</Note>

Why it matters. asks the agent to drop prior instructions or safety

Fix. remove the instruction

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

counter_reset, extension_set_dynamic, render_reset, resetCounter

Why it matters. 4 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

.actrc

.actrc

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.syncpackrc.cjs

.syncpackrc.cjs

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

e2e/web-standards-showcase/src/main.ts:253

eval(code);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

e2e/test-app/src/runtime-contract-globals.d.ts:1

import type { RuntimeContractController } from '../../runtime-contract/core.js';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

e2e/test-app/src/runtime-contract-iframe-child.ts:2

import { installModelContextRuntimeContract } from '../../runtime-contract/model-context-contract.js';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

e2e/test-app/src/runtime-contract.ts:4

import { installModelContextRuntimeContract } from '../../runtime-contract/model-context-contract.js';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

e2e/web-standards-showcase/src/components/ui/badge.tsx:5

import { cn } from '../../lib/utils';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

packages/global/conformance/global-runtime.e2e.test.ts:1

import { runRuntimeCoreConformanceSuite } from '../../../conformance/runtime-core-conformance.shared.js';

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

apps/documentation-website/packages/webmcp-extension/reference.mdx:55

"matches": ["https://*/*", "http://localhost/*", "http://127.0.0.1/*"],

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

apps/documentation-website/packages/webmcp-extension/reference.mdx:61

"matches": ["https://*/*", "http://localhost/*", "http://127.0.0.1/*"],

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

apps/documentation-website/reference/webmcp/codex-site-tools.mdx:38

| Test page      | `http://127.0.0.1:41739` top-level page with `window.isSecureContext === true`              |

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/research/codex-site-tools-2026-08-27/README.md:11

- `http://127.0.0.1:41739`, where `window.isSecureContext === true`

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/research/codex-site-tools-2026-08-27/README.md:23

Open `http://127.0.0.1:41739` in ChatGPT's built-in browser. The server maps

LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94

packages/smart-dom-reader/test/local-playwright-runner.mjs:95

<img src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iNDAwIiBoZWlnaHQ9IjIwMCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj48cmVjdCB3aWR0aD0iNDAwIiBoZWlnaHQ9IjIwMCIgZmlsbD0iI2RkZCIvPjx0ZXh0IHg9IjUwJSIg

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

apps/documentation-website/package.json

mintlify

Why it matters. 1 dependency range(s) float