Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add juan294/cc-rpi --skill webmcpgit clone --depth 1 https://github.com/juan294/cc-rpiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/juan294/cc-rpi/webmcp)<a href="https://agentmods.dev/skills/juan294/cc-rpi/webmcp"><img src="https://agentmods.dev/badge/skills/juan294/cc-rpi/webmcp.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.02054 |
| Opus 5 | $0.00026 | $0.01027 |
| Sonnet 5 | $0.00011 | $0.00411 |
| Haiku 4.5 | $0.00005 | $0.00205 |
Grade A, and why
webmcp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 256 lines — stays where its author put it; the contents beside it link to each section on GitHub.
WebMCP
The API Surface
WebMCP exposes a page's capabilities to an in-browser agent through
document.modelContext. A tool is registered with a name, a description, an
input schema, and a handler:
const controller = new AbortController();
document.modelContext.registerTool(
{
name: "add_to_cart",
description: "Adds a product to the shopping cart by SKU.",
inputSchema: { type: "object", properties: { sku: { type: "string" } }, required: ["sku"] },
async execute({ sku }) {
await cart.add(sku);
return { content: [{ type: "text", text: `Added ${sku} to cart.` }] };
},
},
{ signal: controller.signal },
);
// later, to unregister:
controller.abort();
The handler's result must be JSON-serializable. The current draft defines
ToolExecuteCallback as Promise<any>; an MCP content envelope is an
application convention, not the required browser return type. executeTool()
resolves to the serialized result. Rejections and serialization failures can
reject execution; expected domain errors can use a documented JSON object
with a recovery message. An agent discovers tools with getTools() and tracks
toolchange events. Registration should last only as long as the view state
that makes the tool usable.
Verified against the WebMCP draft dated 4 September 2026. This is an evolving community draft, not a W3C standard. Feature-detect the actual browser API and keep it behind an adapter; do not infer availability from a version number alone. The global examples here belong in that adapter.
One Tool, One Function
Wrong -- a single tool with a mode switch covering unrelated operations:
document.modelContext.registerTool({
name: "manage_booking",
description: "Search, filter, or book reservations depending on mode.",
inputSchema: {
type: "object",
properties: { mode: { enum: ["search", "filter", "book"] }, params: { type: "object" } },
},
async execute({ mode, params }) {
// agent picks the wrong mode -> silently runs the wrong branch, no error surfaces
},
});
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · -6 lines 9bb3096d0174
- 4d ago First seen · 262 lines · 53 tokens per session scan A e065f0ab762a
webmcp is a skill published in the GitHub repository juan294/cc-rpi (5 stars, last pushed yesterday), licensed MIT. It adds 53 tokens to every session and 2,054 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
ui-verification
Runs scoped browser probes for focus, hit targets, overflow, themes, request failures, and performance attribution, with evidence linked to UI rule IDs. Use when asked to "verify this in the browser", "reproduce this finding", or "check the fix". For source audits and severity use ui-design; field metrics require RUM…
cmux-browser
Browser automation with cmux embedded webviews (not Chrome/Chromium). Use when $CMUXWORKSPACEID is set and you need to open sites, interact with pages, wait for state changes, or extract data. Snapshot/ref workflow for reliable element targeting.
ops-browser
Use when directly operating or verifying a specified page, capturing screenshots or browser-native recordings, collecting same-state visual/computed evidence, or gathering isolated browser-layer evidence, especially when existing login state, tabs, downloads, or non-interrupting background operation matter; require a…
playwright-stability
Make a Playwright E2E suite stable and realistic — kill flaky tests and authenticate like a real user via storageState (login once, reuse). Use when E2E tests are flaky, slow, re-login in every test, mock auth instead of using it, or when hardening a suite before relying on it.
web-browse
Navigate websites and interact with web pages as a human user. Use when needing to browse, scrape, extract data from, or interact with websites that require real browser behavior (login flows, dynamic content, CAPTCHAs, bot detection, etc.). Triggers on phrases like "browse to", "go to website", "open webpage", "check…
stagehand
Write self-healing browser automation with Stagehand (act/extract/observe) — natural-language steps on top of Playwright that survive UI changes without rewriting selectors. Use for the parts of a flow that change often, or when scripted Playwright selectors keep breaking. Pilot it against one volatile flow before…