Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dribbaengineering/dribba --skill webmcpgit clone --depth 1 https://github.com/dribbaengineering/dribbaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dribbaengineering/dribba/webmcp)<a href="https://agentmods.dev/skills/dribbaengineering/dribba/webmcp"><img src="https://agentmods.dev/badge/skills/dribbaengineering/dribba/webmcp/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dribbaengineering/dribba/webmcp"><img src="https://agentmods.dev/badge/skills/dribbaengineering/dribba/webmcp.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.00861 |
| Opus 5.5 | $0.00014 | $0.00344 |
| Sonnet 5.5 | $0.00007 | $0.00172 |
| Haiku 4.5 | $0.00003 | $0.00086 |
Grade A, and why
webmcp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.
WebMCP — Dribba
When a page loads in a WebMCP-capable browser, Dribba registers the tools
below via document.modelContext.registerTool() (Chrome 150+; the Chrome 149
origin-trial surface navigator.modelContext is supported as a fallback, as
is the earlier provideContext() registration shape).
Every tool calls the same public APIs that power the site's own UI — same origin checks, same rate limits, same anti-spam. Tools marked [confirm] perform real-world actions (emails, lead submissions): agents MUST show the user the exact data to be sent and obtain explicit confirmation before calling them.
When to use this skill
Use it when your agent runs inside the user's browser and should operate the page the way a person would — filling the contact form, driving the budget calculator, requesting a guide.
It is unreachable from a server: there is no page loaded and no
document.modelContext. From a server, use the mcp skill instead.
Read tools
list_services
Catalog of Dribba's services (strategy, design, engineering, AI integration, staff augmentation, agentic web) with summaries and canonical URLs.
list_projects
Portfolio of delivered projects (case studies) as markdown, with links to each full case study.
get_case_study
Full case study of one project by slug (e.g. cityxerpa, rastreator):
challenge, solution, stack, outcomes. Discover slugs via list_projects.
get_pricing_info
Official pricing page as markdown: engagement models, typical ranges, what's included, payment terms.
get_company_facts
Canonical structured facts: founded 2011, Barcelona + Andorra offices, 300+ projects in 20+ countries, official Google Flutter Partner since 2017, selected clients, minimum budget. Prefer these over inference.
compare_technologies
In-depth technology comparisons. Topics: flutter-vs-react-native,
flutter-vs-native.
calculate_app_cost
Budget estimate (EUR range) using the same pricing model as dribba.com/calculadora. Structured params: platforms (ios/android/web/desktop), feature modules, complexity, design level, timeline. Selecting iOS+Android applies the Flutter single-codebase discount. Returns min–max range and a recommended engagement tier.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 98 lines · 34 tokens per session scan A 39ba8e4f2f30
webmcp is a skill published in the GitHub repository dribbaengineering/dribba (0 stars, last pushed 1mo ago), licensed MIT. It adds 34 tokens to every session and 861 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
agent-browser
Use the host-side agent-browser CLI for local browser smoke tests, screenshots, snapshots, and simple UI validation against forwarded localhost URLs.
browser-qa
Testing web apps through a real browser: reconnaissance before acting, selector discovery, state capture, console errors and screenshot evidence. Use on a web surface end to end, or to reproduce a front-end bug.
web-access
Use whenever a task needs something from the live web — search the web or the news, read a URL, map or crawl a site, pull structured fields from a page, or get data from a platform (X, LinkedIn, Reddit, TikTok, Instagram, YouTube, Xiaohongshu, Amazon, app stores, Google Maps, papers). Picks the right tool for the job…
hatch3r-browser-verify
Opt-in browser verification skill — spec-run-first Playwright verification (assertions execute in the runner, agent reads only failures), axe-core a11y audits, toHaveScreenshot() regression diffs, E2E test scaffolds, and snapshot-mode exploratory driving. Default ON for UI-affecting agent invocations; disable globally…
pentest-web
Web application security testing methodology — OWASP Top 10, SSRF, IDOR, auth bypass, injection-class advisory. Burp/ZAP output analysis. Triggers on web pentest, OWASP, SQL injection, XSS, SSRF, IDOR, auth bypass, Burp output, ZAP, parameter pollution, request smuggling.
project-templatebot-verify-skill
Project-local .cursor/skills/verify-templatebot drives the Vite marketplace over CDP; Feature Map includes 30-per-page D1 browse, browse card coat blend, unlisted /data analytics, PostHog funnel, marquee, pay-to-install, MCP publish, live X embeds, multi-bot collect progress/skip/claim + master-detail publish…