Borrowing it
Nothing to install: this file belongs to searchstefano/agenticschema. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/searchstefano/agenticschema/main/.agent/skills/build-webmcp-tools/SKILL.mdgit clone --depth 1 https://github.com/searchstefano/agenticschemaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/searchstefano/agenticschema/build-webmcp-tools)<a href="https://agentmods.dev/skills/searchstefano/agenticschema/build-webmcp-tools"><img src="https://agentmods.dev/badge/skills/searchstefano/agenticschema/build-webmcp-tools/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/searchstefano/agenticschema/build-webmcp-tools"><img src="https://agentmods.dev/badge/skills/searchstefano/agenticschema/build-webmcp-tools.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00157 | $0.04132 |
| Opus 5.5 | $0.00063 | $0.01653 |
| Sonnet 5.5 | $0.00031 | $0.00826 |
| Haiku 4.5 | $0.00016 | $0.00413 |
Grade A, and why
build-webmcp-tools scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **Live site**: explain that tools must be registered by code running in the page (first-party code or an extension/content script) on `document.modelContext`, not by headless scraping. **If `chrome-devtools` MCP (or an How it starts
The opening of the file, as written. The whole thing — 129 lines — stays where its author put it; the contents beside it link to each section on GitHub.
WebMCP Tool Development Workflow (build-webmcp-tools)
WebMCP lets a web page expose client-side capabilities as structured tools to in-browser AI agents on document.modelContext, instead of agents scraping or clicking the DOM. This skill routes a developer to the right stage of the tool lifecycle and points to the reference file that holds the detailed rules and code for that stage.
Key tenet: WebMCP runs client-side in the browser tab on document.modelContext, inside the user's authenticated session. It supports Tools only (no Resources or Prompts). It is not a backend MCP server over stdio/SSE, and tools execute application logic (state stores, APIs, client routers) directly rather than simulating typing or clicks.
How to Use This Skill
- Match the developer's request to a row in the Router and go to that stage.
- Read the files in the "Read first" column before responding. Paths are relative to this skill's directory. This file only summarizes them; the detailed rules, examples, and code patterns live in the references, so do not answer from this summary alone.
- If the request refers to an artifact you were not given (transcripts,
schema.json, source files), read it if it is available in the workspace; otherwise ask for it, and outline how you will apply the stage's key rules from its reference file (for audits, include the verification steps). Never invent the missing artifact. - Apply the Non-Negotiables to everything you produce.
- Before finishing an audit,
schema.json, or implementation, check your output againstreferences/audit-checklist.md.
Non-Negotiables
- Budgets: tool and parameter names ≤ 30 chars; tool descriptions ≤ 500 chars; parameter descriptions ≤ 150 chars; output ≤ 1,500 chars (~400 tokens), paginated. → tool-design.md
- Descriptions: "What + When" (what the tool does, when to choose it); never repeat
inputSchemaparameters; no implementation jargon (Redux, Pinia, Express, REST, GraphQL, gRPC). → tool-design.md - Naming & shape: action verbs;
initiate_*for tools that open a form or wizard vs.book_*/create_*for immediate execution; never make the model compute values (relative dates, conversions): accept the user's phrasing and resolve it in the app, though unambiguous lookups to standard codes are fine; prefer names over opaque IDs; recommended: consolidate entities that share a lifecycle and annotations into polymorphic, batched tools, keeping trusted and user-authored content in separate tools. → tool-design.md - Annotations: all hints default to false and are strictly opt-in (specify only when true; never declare : false);
readOnlyHint: trueonly on pure queries;consequentialHint: trueonly on significant, irreversible real-world actions (payments, bookings, deletions); view navigation, tab switching, andinitiate_*hand-offs must not declarereadOnlyHint: true(omit it) and do not needconsequentialHint, protecting unsaved work inside the tool; routine mutating tools omit annotations;untrustedContentHint: trueon any output containing user- or third-party-authored text, even from your own database. → annotations.md - Errors reach the agent: React
useWebMCPthrowsError(→isError: true); nativeregisterToolresolves{ error, code, retryable }because rejections become a genericDOMException: UnknownError; declarative forms resolve structured field errors viaevent.respondWith. → error-handling.md - UI sync: await state and DOM updates before a tool returns.
- Cross-origin: tools are same-origin by default (Permissions Policy
tools, defaultself); delegate only with<iframe allow="tools">plusregisterTool(tool, { exposedTo: ['https://trusted.origin'] }); origin isolation is required (Origin-Agent-Cluster: ?0disables WebMCP). → vanilla-patterns.md - Design before code: every tool goes through Stages 2–4 (starting states, role-play, variations, and critique of tone, clarifying questions, and autonomous boundaries) before Stage 5–6 schemas, evals, or code; implementation simplicity is not conversational simplicity. Run Stages 2–6 in Interactive Mode (pausing after each goal's role-play for developer critique) or Autonomous Mode (working through each isolated goal's Stages 2–4, self-critique, and Stage 5–6 consolidation/code end-to-end without stops). Only skip Stages 2–4 on the Explicit Fast Path below when asked to skip design for one tool. → conversational-design.md
What ships with it
32 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- evals/evals.json 76 KB
- evals/fixtures/hotel-app/schema.json 1.1 KB
- evals/fixtures/project-app/roleplay-triage.md 1.7 KB
- evals/fixtures/project-app/src/tools/project-tools.ts 2.5 KB runs code
- evals/fixtures/recipe-app/package.json 404 B
- evals/fixtures/recipe-app/src/App.tsx 990 B
- evals/fixtures/recipe-app/src/store.ts 906 B runs code
- evals/suites/auditing-readiness.json 6.9 KB
- evals/suites/core-principles.json 20 KB
- evals/suites/stage-0-router.json 15 KB
- evals/suites/stage-1-ideation.json 2.7 KB
- evals/suites/stage-2-context.json 777 B
- evals/suites/stage-3-roleplay.json 683 B
- evals/suites/stage-4-boundaries.json 3.3 KB
- evals/suites/stage-5-specs.json 9.2 KB
- evals/suites/stage-6-frameworks.json 19 KB
- evals/trigger-queries.json 3.7 KB
- references/agent-security.md 8.8 KB
- references/angular-patterns.md 6.0 KB
- references/annotations.md 9.4 KB
- references/audit-checklist.md 10 KB
- references/conversational-design.md 12 KB
- references/declarative-patterns.md 11 KB
- references/error-handling.md 4.1 KB
- references/evals-format.md 14 KB
- references/live-site-discovery.md 3.4 KB
- references/react-patterns.md 18 KB
- references/sources.md 7.3 KB
- references/testing-and-debugging.md 7.2 KB
- references/tool-design.md 8.7 KB
- references/use-case-template.md 6.8 KB
- references/vanilla-patterns.md 9.6 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 129 lines · 157 tokens per session scan A 2ef4db0bd1b3
build-webmcp-tools is a skill published in the GitHub repository searchstefano/agenticschema (5 stars, last pushed 13d ago), licensed MIT. It adds 157 tokens to every session and 4,132 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-26.
build-webmcp-tools compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| build-webmcp-toolssearchstefano/agenticschema | Skill | 5 | 13d ago | MIT | A | 157 | Claude Code, Codex |
| flutter-app-links-deep-link-engineeringariaramin/flutter-skills | Skill | 8 | 7d ago | MIT | A | 145 | Claude Code, Codex |
| x402browser-use/browser-use | Skill | 120k | yesterday | MIT | A | 175 | Claude Code |
| browser-usebrowser-use/browser-use | Skill | 120k | yesterday | MIT | A | 57 | Claude Code, Codex |
| cloudbrowser-use/browser-use | Skill | 120k | yesterday | MIT | A | 177 | Claude Code |
| opencli-autofixjackwener/OpenCLI | Skill | 31k | yesterday | Apache-2.0 | A | 61 | Claude Code |
| opencli-browserjackwener/OpenCLI | Skill | 31k | yesterday | Apache-2.0 | A | 43 | Claude Code |