Web Debug MCP v0.7.0

Web Debug MCP 0.7.0

0.7.0 adds a bounded direct-only Chrome WebMCP path and hybrid native-test authoring while keeping the public MCP catalog at 13 tools.

Highlights

• Adds direct WebMCP actions with bounded JSON arguments, opaque string/null results, fixed same-origin tool identity, and truthful webmcp-page-api provenance.
• Keeps WebMCP out of reproduction scenarios, retries, replay restoration, and server reset; every attempted call suppresses later screenshots and makes the replay generation non-restorable.
• Adds discover-only untrusted WebMCP capture metadata and the corresponding final wire-version cascade.
• Adds webmcp-tool-authoring alongside strengthened manual-parity-qualification and web-debug-workflow skills.
• Preserves repository-native UI/API/domain verdict authority and requires independent mutation evidence.
• Retains Safari WebDriver/BiDi after Safari 27 MCP failed the strict full-cutover gate; the workflow may use only the separately configured handle-scoped Safari MCP console/network diagnostic subset.

Compatibility and safety

Chrome WebMCP requires explicit browser support/activation and is reported as page-provided untrusted API, not native-browser attestation. Safari MCP diagnostics never merge with the authoritative Safari WebDriver session or award qualification PASS. Targets remain loopback-first, evidence remains bounded/redacted, and the package adds no hosted or production authority.

Verification

Final acceptance requires deterministic tests, typecheck/build, native harness, three skill validators, plugin validation, exact-archive Node 20/22/24 handshakes, live Chrome/WebMCP/framework/Safari WebDriver smokes, public fresh-cache install, exact source/tag/npm/GitHub identity, and one installed released Codex plugin with three skills and no duplicate MCP registration.

Web Debug MCP v0.6.0

Web Debug MCP 0.6.0

0.6.0 keeps the 13-tool MCP catalog while making routine capture smaller and more explicit, strengthening project/runtime capability truth, and adding reviewed manual-parity qualification as a second bundled plugin skill.

Capture and schema changes

• web_issue_capture replaces captureScreenshot with summary (default), full, include, and delta profiles. Summary produces no pixels; screenshots and detailed surfaces require explicit full/include requests.
• Manual capture and authoritative evidence use schema 4. Scenario and verification results use schema 5; project/session detection uses schema 2 and environment fingerprints use schema 3.
• All 13 tools advertise and enforce concrete result data schemas.
• Delta cursors are bounded, reusable, session-owned, and exclude replay/screenshot side effects unless explicitly requested.
• Local screenshot paths stay private, including warning and error text.

Detection, capabilities, and architecture

• Project detection separates confirmed application evidence from weak dev/peer dependency candidates and reports declared workspace candidates without selecting one automatically.
• Doctor schema 2 warns for weak or ambiguous roots and points callers to exact declared workspace candidates.
• Sessions report projectCapabilities separately from adapter-negotiated runtimeCapabilities, including Chromium launch/attach and Safari WebDriver/BiDi differences.
• SessionManager remains the policy façade while replay, evidence projection/cursors, scenario contract/verification, lifecycle, operation context, and private-value handling live in focused modules.

Manual-parity qualification

• The plugin now bundles manual-parity-qualification alongside web-debug-workflow.
• Approved manual cases—or source-backed candidate requirements when no manual baseline exists—map to repository-native Playwright/API/domain tests through reviewed qualification and crosswalk metadata.
• Qualification JSON is non-executable. Selectors, browser actions, API calls, setup, and assertions remain typed native test code.
• The read-only validator enforces source/reviewer state, exact catalog/crosswalk digests, case-scoped evidence, unique native-test ownership, required evidence facets, mutation proof, and truthful aggregate verdicts.
• Web Debug evidence remains diagnostic-only and cannot award qualification PASS.

Migration

• Replace captureScreenshot with a capture profile.
• Request full or an include profile when screenshots, framework data, network/console detail, or other non-summary surfaces are required.
• Branch on the advertised schema versions rather than inferring data shape from package version.
• No legacy capture alias or dual output shape is retained.

Verification and limits

The frozen source passed 31 deterministic test files / 155 tests, source and test typecheck, build, native and formal harness checks, both skill validators, plugin validation, exact-archive installation/stdio schema checks, Chromium/framework/local-fidelity smokes, and the six-scenario comparison demo. Final archive and public-registry identities are recorded in the release ExecPlan.

Safari 26.6.2 deterministic WebDriver/BiDi and negotiated-capability contracts pass. A fresh source-next live Safari capture remained blocked after two fixture wait timeouts on this host, so this release does not relabel that run as a fresh Safari PASS; immutable 0.5.0 Safari live evidence remains historical. Approved external CDP, provider-backed production authority, a fresh HMAC certification overlay, the Node CI matrix, and repeated real-project agent evaluations remain separate or deferred scope.

Web Debug MCP v0.5.0

Web Debug MCP 0.5.0

0.5.0 adds bounded Angular and Vue runtime evidence and closes two security/reliability defects found during final-release review without expanding the 13-tool MCP catalog.

Highlights

• Adds evidence-schema-3 Angular 21 development snapshots through documented window.ng globals, with bounded DOM-host component/state/change evidence and no private-Ivy traversal.
• Adds Vue 3 development snapshots through a safely chained DevTools hook, with bounded app/component trees, props/state changes, source hints, and optional Vite HMR provenance.
• Keeps React, Vite, Next.js, Chromium, Safari, replay, and schema-version-4 adaptive verification behind the existing single MCP facade.
• Promotes the Codex/ChatGPT/Claude Code plugin and its bundled runtime to immutable web-debug-mcp@0.5.0.

Security and reliability corrections

• Replaces token-only raw text redaction with deterministic sensitive-assignment parsing. Authorization/Proxy-Authorization and Cookie/Set-Cookie logical fields, camel/underscore aliases, raw/escaped quoted values, multiline values, JSON-style quoted keys, and marker-prefix suffixes are redacted while unrelated lines and sibling fields remain intact.
• Makes process-registry session accounting an absolute projection of live SessionManager state during the existing locked request-finalization update. Failed bookkeeping no longer replaces a completed MCP result, and repeated/concurrent close or later artifact deletion cannot decrement another active session.

Compatibility and boundaries

• Evidence bundles use schema version 3; scenario and verification results remain schema version 4.
• Angular runtime evidence is development-only and Chromium-only. Angular CLI's internal Vite server is not treated as the Web Debug Vite endpoint.
• Vue support targets the verified Vue 3 DevTools-hook contract and has no DOM-private fallback. Safari keeps generic browser evidence and explicit framework-enrichment warnings.
• Node 20+ remains declared; exact locally verified runtime/framework versions are recorded in ../COMPATIBILITY.md.
• The package remains a local stdio development tool. This release is not a provider-backed production attestation and does not add unattended remote-browser authority.

Verification

The release candidate passed 124 deterministic tests, source/test typecheck, build, native and zero-error formal harness checks, independent security bypass/regression review, focused MCP/Next redaction and lifecycle-accounting fault tests, plugin/skill validation, an exact 116-entry archive/fresh-prefix handshake, Node 20/22/24 distribution handshakes, Chromium, React/Vite, Vue/Vite, Angular, Next, Safari 26.6.2, local-fidelity, and all six comparison scenarios. Safari evidence includes WebDriver DOM/action/screenshot, BiDi console, explicit debugger/profile limitations, and disclosed Performance Resource Timing network fallback. Public-registry, GitHub, and installed-plugin evidence is recorded in the complete-0-5-0-release ExecPlan as each external gate completes.

Web Debug MCP v0.4.0

Web Debug MCP 0.4.0

0.4.0 is a breaking contract release focused on trust boundaries, MCP-native output, and first-run reliability.

Highlights

• Fixes the selected top-level origin before navigation and rejects cross-origin redirects, actions, reloads, and popup-first documents in Chromium; Safari quarantines escaped WebDriver state.
• Adds schema-version-4 scenarios/results, MCP output schemas, canonical structuredContent, bounded progress, and opaque screenshot resources.
• Adds transactional resource handles, late-write cleanup, 4 MiB/file and four-file/16 MiB session screenshot quotas, explicit artifact retention/deletion, and destructive private session close.
• Adds press, exact select, declared check, hover, and scroll-into-view through the existing browser-action tool, with private fill/select replay and screenshot rules.
• Adds the bounded doctor CLI, full 13-tool in-memory routing coverage, source/test type checking, compatibility evidence, deterministic agent-evaluation grading, and process-group smoke teardown.

Breaking changes

• Scenario and verification schemas move to version 4; obsolete aliases and compatibility shapes are removed.
• Successful handler results use the canonical { ok, data, error, artifacts, warnings } structured envelope. MCP SDK input-validation failures remain protocol-level exceptions before handler dispatch.
• Closed sessions retain only a bounded sanitized tombstone. Fill/select inputs suppress screenshot pixels and are never restorable from public replay.

Verification

Verified locally with 106 deterministic tests, source/test typecheck, build, native and formal harness checks, plugin validation, final tarball/fresh-prefix stdio handshake, Chromium/React-Vite/Next/Safari/local-fidelity smokes, and the six-scenario comparison demo. This is local release evidence, not provider-backed production attestation.

Web Debug MCP v0.3.3

Forward-only metadata correction for the Web Debug routing release.

• Keeps the plugin as a complement to Build Web Apps and deterministic Vitest, Go, and project Playwright runners.
• Preserves explicit @web Debug routing and native-runner handoff boundaries.
• Aligns MCP serverInfo.version with the 0.3.3 package and plugin metadata.
• The public npm package is pinned immutably at web-debug-mcp@0.3.3.

Web Debug MCP v0.3.2

Clarifies Web Debug plugin routing and positions it as a browser-evidence complement to Build Web Apps and deterministic native runners.

• Explicit @web Debug requests select the bundled Web Debug workflow.
• Exact Vitest, Go, and project Playwright failures remain on native runners.
• Mixed tasks keep runner evidence and browser evidence distinct.
• Plugin metadata and the immutable MCP runtime pin are updated to 0.3.2.

Web Debug MCP v0.3.1

Full Changelog: v0.3.0...v0.3.1

Web Debug MCP v0.3.0

Full Changelog: v0.2.0...v0.3.0

Web Debug MCP v0.2.0

Full Changelog: https://github.com/MarlonJD/web-debug-mcp/commits/v0.2.0