webmcpify v0.5.1

webmcpify v0.5.1

This patch keeps native verification aligned with the WebMCP CG draft and
Chrome's September 11 execution update.

• Current browsers receive a JavaScript object in executeTool(); Chrome 150's
  deprecated JSON-string input remains supported.
• A temporary, side-effect-free probe chooses the browser input mode before any
  application tool runs. Real tools are never retried, preventing duplicate
  mutations when a handler fails after changing state.
• The verification template, visual Workbench, ambient types, and reproducible
  native proof accept both the current object-shaped and older stringified
  inputSchema evidence.
• Native proof records whether consequentialHint is exposed instead of assuming
  Chrome 150's omission remains universal.

Primary compatibility references:

• https://webmachinelearning.github.io/webmcp/
• https://developer.chrome.com/docs/ai/webmcp/imperative-api
• web-platform-tests/wpt@1a21db9
• web-platform-tests/wpt@c94abb3

webmcpify v0.5.0

webmcpify v0.5.0

webmcpify now asks for a coverage target up front:

• curated maps a reviewed set of high-value actions and records why other
  interaction classes were deferred.
• parity inventories every interactive element on every authenticated route and
  maps each one to a WebMCP tool or a written reason. The route census—not a tool
  count—is the audit evidence.

The rest of the pipeline is stricter where real integrations failed:

• DETECT refuses to inventory on an insecure verification origin and records
  backend-origin/CORS assumptions before tool work begins.
• Inventory verdicts carry the policy that produced them; widening a gate reopens
  affected areas automatically.
• Identity, tenancy/billing, credentials and destructive-delete gates use separate
  vocabulary, so creating ordinary product objects is no longer mistaken for
  account creation.
• Imperative tools cannot return bare null/undefined; route-changing tools
  return a structured result before deferring navigation and disposal.
• HEAL classifies failures before counting independent retries and resets the
  counter after an approved contract revision.
• The verification template requires a secure env-provided origin, a dedicated
  Chrome profile and a real headed browser environment.
• A temporary, agent-launched WebMCP Workbench now compares approved manifest
  tools with live registrations, builds schema-driven examples, and labels every
  result as Native or Simulated. Simulated evidence never counts as verification.
• The current CG draft's consequentialHint is carried through inventory,
  ambient types, integration guidance and verification. It signals significant
  real-world or non-reversible effects without replacing application-enforced
  authorization, confirmation, idempotency or replay protection. Chrome's current
  documentation includes the hint, but the local Chrome 150 proof accepted it at
  registration and still omitted it from getTools(); native propagation is not
  claimed until the target browser actually returns the field.
• Native Chrome's stringified I/O and spec-shaped object stubs now use an explicit
  adapter mode, avoiding heuristic retries that could execute a mutation twice.

The skill also documents ChatGPT's Site tools surface separately from Chrome
developer verification. Availability details are dated 2026-08-31 and link to the
official OpenAI documentation because model/workspace support can change. ChatGPT's
built-in browser currently discovers top-level imperative tools, not declarative
forms or iframe registrations; that client subset is separate from Chrome's broader
WebMCP implementation.

Compatibility note: no public source or measured client run establishes a universal
safe tool count per page. Parity is an auditable coverage target, not a promise that
every client will accept an arbitrarily large route toolset; client-capacity gaps are
reported honestly.

Thanks to @arnabwithab for the native/stub I/O
compatibility work in #13.

webmcpify v0.4.0

Manifest v3, approval-gated discovery, current document.modelContext support, and a reproducible native-Chrome proof run.

Highlights:

• explicit auth fixtures and client/server mutation classes
• optional .well-known/webmcp discovery with drift checks
• native Chrome enumeration and execution verification
• downloadable 63-second proof recording, source capture, and checksums

Install:

npx skills add TueJon/webmcpify