webmcp-react: Instructions file for Codex

AGENTS.md

webmcp-react AGENTS.md is an instructions file for Codex, OpenCode from agentcathq/webmcp-react. It costs 1,694 tokens per session, scanned A, original, MIT.

A contributor guide for webmcp-react, a React library that implements the WebMCP standard for exposing web-app capabilities to AI agents. It covers the library’s structure, commands, API references, and design decisions.

In plain words
What is it for?
Use it when installing, building, testing, type-checking, linting, or contributing to webmcp-react. It also points contributors to the WebMCP specification and API documentation.
Why use it?
It gives coding agents the project context they need before changing the library, reducing the risk of treating intentional architecture or documentation as bugs.

Instructions file for CodexOpenCode

Written for Codex and OpenCode: the file is AGENTS.md. Also seen: mentions AGENTS.md.

This is agentcathq/webmcp-react's own configuration. It tells Codex and OpenCode how to work on webmcp-react itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything webmcp-react configures →

Reuse

Borrowing it

Nothing to install: this file belongs to agentcathq/webmcp-react. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/agentcathq/webmcp-react/main/AGENTS.md
Clone the repo
git clone --depth 1 https://github.com/agentcathq/webmcp-react

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for webmcp-react AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/agentcathq/webmcp-react/agents-md/github.svg)](https://agentmods.dev/instructions/agentcathq/webmcp-react/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/agentcathq/webmcp-react/agents-md"><img src="https://agentmods.dev/badge/instructions/agentcathq/webmcp-react/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for webmcp-react AGENTS.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/agentcathq/webmcp-react/agents-md"><img src="https://agentmods.dev/badge/instructions/agentcathq/webmcp-react/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 1,694 This file is loaded in full into every session.
When invoked 1,694 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.01694 $0.01694
Opus 5.5 $0.00678 $0.00678
Sonnet 5.5 $0.00339 $0.00339
Haiku 4.5 $0.00169 $0.00169

Measured 1mo ago against content hash ff673781d1bd, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

webmcp-react AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 111 lines

How it starts

The opening of the file, as written. The whole thing — 111 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

This file is for AI agents contributing to the webmcp-react library. For integrating webmcp-react into your app, see the skills/ directory.

Reference

Commands

Task Command
Install pnpm install
Build pnpm build
Test pnpm test
Test (watch) pnpm test:watch
Test (single file) pnpm test -- path/to/file.test.tsx
Type check pnpm typecheck
Lint pnpm lint
Lint + fix pnpm lint:fix
Full check before PR pnpm build && pnpm typecheck && pnpm lint && pnpm test

Project Structure

src/                    ← core library (your focus)
├── index.ts            ← public API exports
├── types.ts            ← all TypeScript types
├── context.tsx         ← WebMCPProvider + useWebMCPStatus hook
├── hooks/
│   └── useMcpTool.ts   ← main hook for tool registration
├── polyfill/           ← document.modelContext polyfill
│   ├── index.ts        ← installPolyfill / cleanupPolyfill + polyfill marker
│   ├── registry.ts     ← in-memory tool storage
│   ├── execute.ts      ← shared execution engine (signals, serialization, errors)
│   ├── testing-shim.ts ← DEPRECATED wrapper over execute.ts (removed in 2.0.0)
│   └── validation.ts   ← input validation against JSON Schema
└── utils/
    ├── schema.ts       ← Zod → JSON Schema conversion + schema fingerprinting
    └── warn.ts         ← dev-only fire-once warnings

Other directories (don't modify unless explicitly asked):

  • extension/ — Chrome extension that bridges web tools to desktop MCP clients
  • examples/playground/ — Wordle demo showcasing dynamic tool registration
  • examples/nextjs/ — Next.js integration example
  • skills/ — agent skills for consumers of the library
  • docs/api.md — full API reference

Architecture Decisions — Don't "Fix" These

Read the full file on GitHub · 111 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago Changed · +1 lines · +46 tokens per session ff673781d1bd
  2. 2mo ago Changed · +6 lines · +245 tokens per session 98eaa58cfe2c
  3. 2mo ago First seen · 104 lines · 1,403 tokens per session scan A c26e8abc6c4a

Subscribe to this mod's changes

webmcp-react AGENTS.md is an instructions file published in the GitHub repository agentcathq/webmcp-react (92 stars, last pushed 10d ago), licensed MIT. It adds 1,694 tokens to every session, about $0.0068 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

webmcp-react AGENTS.md compared with instructions from other repositories

webmcp-react AGENTS.md next to 6 instructions from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
webmcp-react AGENTS.mdagentcathq/webmcp-reactInstructions file9210d agoMITA1,694Codex, OpenCode
vscode buildNext.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA9,719GitHub Copilot
next.js AGENTS.mdvercel/next.jsInstructions file143kyesterdayMITA7,461Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchainInstructions file149kyesterdayMITA4,680Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA5,516GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA3,093GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harnessInstructions file274k2d agoMITA4,313Codex, OpenCode