webmcp

A set of tools that Dribba places inside its website so AI agents running in a user's browser can operate the page.

In plain words
What is it for?
Use it to list services and projects, fill contact forms, use the budget calculator, or request guides. Actions such as sending emails require user confirmation.
Why use it?
It lets an agent use the site's own functions without manually interpreting every form or page element.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/dribbaengineering/dribba/webmcp
Any agent
npx skills add dribbaengineering/dribba --skill webmcp
Clone the repo
git clone --depth 1 https://github.com/dribbaengineering/dribba

Made for: Claude Code, Codex.

Per session 34 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 861 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00034 $0.00861
Opus 5 $0.00017 $0.00430
Sonnet 5 $0.00007 $0.00172
Haiku 4.5 $0.00003 $0.00086

Measured yesterday against content hash 39ba8e4f2f30, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

webmcp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/webmcp/SKILL.md · 98 lines

How it starts

The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.

WebMCP — Dribba

When a page loads in a WebMCP-capable browser, Dribba registers the tools below via document.modelContext.registerTool() (Chrome 150+; the Chrome 149 origin-trial surface navigator.modelContext is supported as a fallback, as is the earlier provideContext() registration shape).

Every tool calls the same public APIs that power the site's own UI — same origin checks, same rate limits, same anti-spam. Tools marked [confirm] perform real-world actions (emails, lead submissions): agents MUST show the user the exact data to be sent and obtain explicit confirmation before calling them.

When to use this skill

Use it when your agent runs inside the user's browser and should operate the page the way a person would — filling the contact form, driving the budget calculator, requesting a guide.

It is unreachable from a server: there is no page loaded and no document.modelContext. From a server, use the mcp skill instead.

Read tools

list_services

Catalog of Dribba's services (strategy, design, engineering, AI integration, staff augmentation, agentic web) with summaries and canonical URLs.

list_projects

Portfolio of delivered projects (case studies) as markdown, with links to each full case study.

get_case_study

Full case study of one project by slug (e.g. cityxerpa, rastreator): challenge, solution, stack, outcomes. Discover slugs via list_projects.

get_pricing_info

Official pricing page as markdown: engagement models, typical ranges, what's included, payment terms.

get_company_facts

Canonical structured facts: founded 2011, Barcelona + Andorra offices, 300+ projects in 20+ countries, official Google Flutter Partner since 2017, selected clients, minimum budget. Prefer these over inference.

compare_technologies

In-depth technology comparisons. Topics: flutter-vs-react-native, flutter-vs-native.

calculate_app_cost

Budget estimate (EUR range) using the same pricing model as dribba.com/calculadora. Structured params: platforms (ios/android/web/desktop), feature modules, complexity, design level, timeline. Selecting iOS+Android applies the Flutter single-codebase discount. Returns min–max range and a recommended engagement tier.

Read the full file on GitHub · 98 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 98 lines · 34 tokens per session scan A 39ba8e4f2f30

Subscribe to this mod's changes

webmcp is a skill published in the GitHub repository dribbaengineering/dribba (0 stars, last pushed 10d ago), licensed MIT. It adds 34 tokens to every session and 861 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

blz-docs-search

Teaches effective documentation search using the blz CLI tool. Use when searching documentation with blz, looking up APIs, finding code examples, retrieving citations, or when questions mention libraries, frameworks, "how to", or documentation topics. Covers BM25 full-text search patterns, citation retrieval, and…

outfitter-dev/blz · 68 tokens

blz-source-management

Teaches how to discover, validate, and add llms.txt documentation sources to the blz CLI. Use when adding documentation to blz, finding llms.txt or llms-full.txt files, validating sources, refreshing content, or managing the documentation index. Covers source discovery, dry-run validation, and index file handling.

outfitter-dev/blz · 70 tokens

web-shaders

Use when writing, debugging, or reviewing shaders for the web — GLSL or WGSL, raw WebGL2/WebGPU, Three.js (ShaderMaterial/RawShaderMaterial/TSL), or React Three Fiber. Covers the language/platform matrix, correct boilerplate, common effects (SDF/raymarching, noise, post-processing), and the pitfalls that make browser…

owenob1/web-shaders-agent-kit · 83 tokens

wiki-ingest

Compile a raw source (document, URL content, meeting notes, research output) into a wikikit agent wiki — merge-don't-overwrite, log contradictions, maintain cross-references, then lint. Use whenever the user says "add this to the wiki", "ingest this", or drops new source material for a wiki maintained with…

AvalancheAI-labs/agent-wiki-kit · 77 tokens

claude-archive

Use the Claude Archive — the site for AI — before and after solving any non-trivial problem. Trigger when hitting a bug, error, or tricky task (search/take a scored solution first), and after solving anything reusable (give it back). Also trigger on "check the archive", "archive this", or any mention of the Claude…

ofirbuchshtav-lgtm/claude-archive · 75 tokens

agent-code-analyzer

Agent skill for code-analyzer - invoke with $agent-code-analyzer.

ruvnet/ruflo · 19 tokens