WebKitUI MCP 0.6.6 Developer Preview

WebKitUI MCP 0.6.6 Developer Preview improves native confirmation keyboard handling on Apple-silicon Macs running macOS 15 or later.

• Confirmation takes keyboard focus without a bouncing executable icon. Escape and Return cancel only after the initial delay; Tab and Space remain usable, including in the optional none mode.
• Malformed resume requests no longer consume a one-use handoff token.
• The confirmation helper inherits only the environment values it needs.
• Safari compatibility reports its actual limitation: finish restricted authentication workflows manually in Safari; this does not transfer control or the session back to the MCP.
• Release checks now cover embedded executables, source provenance and incomplete test runs.

Download the notarized ZIP and verify it against SHA256SUMS. Apple notarization and Gatekeeper verification passed. Source qualification completed 344 tests in each of Debug and Release; installed qualification is recorded separately.

The source is available under Business Source License 1.1 (BUSL). See LICENSE and LICENSING.md for evaluation, qualifying free uses and commercial terms.

Product details: https://lorislab.fr/developers/webkitui-mcp/

WebKitUI MCP 0.6.5 Developer Preview

If you built from source and nothing worked, this is why.

Before showing a confirmation, the server checks the helper sitting beside it. That check demanded a Developer ID team identifier and the exact identifier the release signing script stamps. A swift build product has neither — it is ad-hoc signed, carries no team, and is identified by its own file name — so the pair the README told you to install was refused. Every navigation failed closed with "the confirmation helper did not present a prompt", and the only installations that worked were signed with the release certificate.

What the check may demand now follows what the server itself is:

Server	What the helper must satisfy
Notarized	same Developer ID team and the release identifier
Built from source (ad-hoc)	sits beside it under its own executable name
Mismatched either way	refused

The relaxation concedes nothing: whoever can write a helper beside an unsigned server can replace that server too, so there the check could only ever assert co-location. The direction that matters stays closed — an unsigned helper can never be smuggled in beside a notarized server, and a notarized server never runs a helper that is not its own.

If you re-sign one binary, re-sign the other with the same identity, or the confirmation will not appear.

Verified end to end on a pure README install: two ad-hoc binaries, no certificate, session opened, confirmation shown, approved, navigation completed.

Everything from the 0.6.x line

• The confirmation panel draws (0.6.2 shipped one that aborted on launch).
• Tab moves between the confirmation buttons, Cancel first.
• "Release host lease" actually releases a lease held by another process.
• THIRD_PARTY_NOTICES.md no longer claims the project is MIT licensed. It is not, and never was — LICENSE is authoritative.
• The pre-notarization verifier starts the confirmation helper and fails the build if it exits instead of presenting.

Verification

• 187 tests pass.
• Developer ID signed (Team TDV6D5L785), hardened runtime, notarized and stapled.

shasum -a 256 -c SHA256SUMS
spctl -a -vv -t exec "WebKitUI MCP.app"

Licensed under the Business Source License 1.1; Change Date 2030-08-28, then Apache 2.0.

WebKitUI MCP 0.6.4 — superseded, use 0.6.5

A licensing correction. v0.6.1, v0.6.2 and v0.6.3 shipped a file saying the project is MIT licensed. It is not.

THIRD_PARTY_NOTICES.md read "The project license is the MIT License in LICENSE", sitting in the same Resources directory as a LICENSE file that is the Business Source License 1.1. The LICENSE file has always been authoritative and has always been BUSL; the notices file simply contradicted it. If you relied on that sentence, the terms that apply are the ones in LICENSE.

Nothing in the repository compared the places that name a licence to one another. A test now does: LICENSE must be the Business Source License, no prose file may name the MIT License, package.json must declare BUSL-1.1, and the SBOM template must carry it as the root licence. It was checked in both directions before being trusted.

The SBOM template also still seeded version 0.6.1. The generator stamps the real version at build time, so no release ever shipped a wrong version in its SBOM, but a reader of the repository saw the wrong number.

Everything from 0.6.3 is still here

• The confirmation panel draws again (0.6.2 shipped one that aborted on launch and made every navigation fail closed).
• Tab moves between the confirmation buttons, with Cancel as the initial responder.
• "Release host lease" actually releases a lease held by another process.
• The pre-notarization verifier starts the confirmation helper and fails the build if it exits instead of presenting.

Verification

• 180 tests pass.
• Developer ID signed (Team TDV6D5L785), hardened runtime, notarized and stapled.

shasum -a 256 -c SHA256SUMS
spctl -a -vv -t exec "WebKitUI MCP.app"

Licensed under the Business Source License 1.1; Change Date 2030-08-28, then Apache 2.0.

WebKitUI MCP 0.6.3 — superseded, use 0.6.5

⚠️ Licence : cette release contredit sa propre LICENSE

THIRD_PARTY_NOTICES.md y déclare "The project license is the MIT License in LICENSE", alors que le fichier LICENSE livré à côté est la Business Source License 1.1. LICENSE fait foi et a toujours été BUSL. La phrase est corrigée à partir de 0.6.4.

Utilisez 0.6.4.

0.6.2 is broken. Use this instead. Its confirmation panel never drew, so no navigation could be approved and the server was unusable. Nothing unsafe happened — every navigation failed closed — but nothing worked either.

What went wrong

The panel's window collection behavior named both canJoinAllSpaces and moveToActiveSpace. AppKit refuses that pair and throws, so the helper aborted before drawing anything.

Signing, notarization and 179 tests all passed on that build, because none of them start the helper. The pre-notarization verifier now does, and fails the build if the helper exits instead of presenting a prompt. It was checked in both directions: it reports the 0.6.2 helper dead with status 134, and the fixed one as presenting.

Tab now goes somewhere

With the panel drawing again, Tab still did nothing in a frontmost window: the details text view is selectable, so it took first responder and kept the key press. The two buttons now form an explicit key view loop that Tab cannot leave, with Cancel as the initial responder — the keyboard lands on the refusal, and reaching Navigate takes a deliberate second press. Verified on hardware, keyboard only, no mouse.

Also in this line (from 0.6.2)

Release host lease actually releases it. The Status window button used to close only the sessions the broker knew about, while the lease is an flock held by a client in its own process — so in the one case an operator reaches for that button it did nothing, silently. It now finds the real holder, refuses to signal anything it cannot vouch for (the pid must be alive and its executable must really be a WebKitUI client, since pids get recycled onto strangers), sends SIGTERM and nothing harsher, and reports the outcome.

Verification

• 179 tests pass.
• Developer ID signed (Team TDV6D5L785), hardened runtime, notarized and stapled.

shasum -a 256 -c SHA256SUMS
spctl -a -vv -t exec "WebKitUI MCP.app"

Licensed under the Business Source License 1.1; Change Date 2030-08-28, then Apache 2.0.

WebKitUI MCP 0.6.2 — superseded, use 0.6.5

⚠️ Do not use this release

The confirmation panel in 0.6.2 never draws. Its window collection behavior names two options AppKit refuses as a pair, so the helper aborts before showing anything and every navigation fails closed with "the confirmation helper did not present a prompt". Nothing unsafe happens — no navigation is ever approved without a human — but nothing works either.

Use 0.6.3. It carries every fix intended for 0.6.2, plus the crash fix and a pre-notarization gate that now starts the helper and refuses to ship a build where it dies.

The original notes follow, for the record.

---

Two defects found by a physical keyboard pass over the operator surfaces.

Release host lease now actually releases it. The Status window button closed the sessions the broker knew about, but the lease is an flock held by a client in its own process. It now finds the real holder, checks the pid is alive and that the executable behind it really is a WebKitUI client, sends SIGTERM and nothing harsher, and reports the outcome.

The confirmation panel opens on Cancel — the refusal, never the approval.

WebKitUI MCP 0.6.1 — superseded, use 0.6.5

⚠️ Licence : cette release contredit sa propre LICENSE

THIRD_PARTY_NOTICES.md y déclare "The project license is the MIT License in LICENSE", alors que le fichier LICENSE livré à côté est la Business Source License 1.1. LICENSE fait foi et a toujours été BUSL. La phrase est corrigée à partir de 0.6.4.

Utilisez 0.6.4.

A native WebKit browser for MCP clients on Apple silicon. Every write passes an
exact local confirmation, and every confirmed write carries a receipt saying what
was dispatched and what was verified.

Install

Unzip and move WebKitUI MCP.app to ~/Applications. Notarised and stapled:
Gatekeeper accepts it without a right-click bypass.

• Apple silicon Mac, macOS 15 or later
• Signed Developer ID Application, Team TDV6D5L785
• Verify with shasum -a 256 against SHA256SUMS

Licence

Business Source License 1.1. The source is readable, auditable and modifiable.
Production use is granted for personal noncommercial use, qualifying
noncommercial organization use, and evaluation. Commercial production use
requires an agreement with the Licensor. This version converts to Apache 2.0 on
2030-08-28.

What changed

Two days of field diagnosis against real submission consoles, fixing the defects
that made the tool wrong rather than merely limited.

• Controls that could not be seen. A Material checkbox renders as a hidden
  input beside an aria-hidden painted box; both halves were filtered away, so
  whole publishing forms observed as empty. The pair is one target now, addressed
  by its visible half and borrowing that half's label.
• Controls that could not be reached. Twenty-two identical anonymous
  checkboxes resolved to twenty-two candidates each. An element is addressed by
  the identity the observation handed out; position separates identical controls,
  but only while the set it indexes is unchanged.
• Pages only partly read, in silence. Truncation and unreadable cross-origin
  frames both returned a partial view with nothing said, and an agent read one as
  a missing declaration and warned its user the app risked rejection.
  Observations now state whether they are complete.
• Same-origin frames are walked and actuated, with geometry translated so a
  click lands where the element actually is.
• Writes reported as failed that had succeeded. A five second budget was
  deciding whether a write happened rather than when to stop waiting. A client
  that believes it failed retries, and a retried write corrupts a page.
• Scrolling moves the container the page actually scrolls; rich text
  editors receive text through WebKit's editing pipeline.

The host lease yields instead of stranding the next client, the holder is named
from its own handshake, the server says why it is exiting, and every element
reports whether it can be acted on and why not.

Known limits

• Cross-origin frames cannot be read. That is a browser boundary. The
  observation says so rather than returning a page that looks complete.
• A control with no layout box is reported and named, never claimed clickable.
• The webkitui-mcp-relay archive is not included: signed, not yet notarised.

Verification

• Notarisation submission 4244a0ca-35ca-4dc0-af35-8e2fbd40f112, accepted,
  stapled, Gatekeeper-verified after stapling
• 276 tests, zero failures, on the repository's serialised gate
• Source manifest reproducible byte-for-byte across regeneration