WebMCPify Guard · Open source

Protection for the person behind every agent action.

Your agent should work for you—not the page it is reading.

WebMCPify Guard is a local security agent that protects users while their AI agents discover, authorize, invoke, and verify website capabilities. Its MCP connection layer makes controlled access to WebMCP sites possible.

Try Guard Inspector ↓Join early access

DEVELOPER PREVIEW The local Inspector works today. The connection, policy, and execution layers are being built in public.

LOCAL OR REMOTEMCP-compatible agentConnects to the user-owned Guard runtime

↓

GUARD PROTECTIONInspect + policyChecks intent, origin, schema, data, and risk

↓

TRUSTED CONSENTAllow · Ask · BlockKeeps approval outside page control

↓

CONNECTION LAYERMCP request → WebMCP invocationBridges only the approved scope

↓

ACTIVE PAGEWebsite WebMCP toolsRun inside the authenticated browser state

↓

INDEPENDENT CHECKVerification + auditReturns structured results and evidence

PROTECTION IS THE PRODUCT—the bridge is one controlled part

How Guard fits

Protect the whole path—not only the approval click.

The agent can plan. Guard keeps inspection, browser authority, policy, consent, execution, and evidence inside a user-controlled route.

01
Connect
Guard accepts a local or remote MCP-compatible agent without giving it unrestricted browser authority.
02
Inspect
Guard checks the site, tool, schema, origin, arguments, untrusted influence, and likely consequence.
03
Constrain
User-owned policy limits the permitted site, tool, data, amount, execution count, and duration.
04
Ask
Allow, ask, or block decisions keep consequential consent in a trusted interface outside page control.
05
Execute
The connection layer translates an approved MCP request into a bounded WebMCP invocation.
06
Verify
Guard checks the resulting state, detects ambiguous or repeated effects, and retains local evidence.

Protection + connection

A security system with a bridge inside it.

The MCP connection layer lets an ordinary compatible agent reach WebMCP-native sites. Guard’s larger job is deciding what that connection may see, send, invoke, and trust.

GUARD PROTECTION LAYER

Screen tool metadata before it reaches the agent
Treat tool outputs as untrusted data
Compare user intent with descriptions, arguments, and likely effects
Keep authenticated browser authority behind trusted consent
Restrict origins and isolate cross-site context
Preview sensitive fields and redact unnecessary data
Detect duplicate, replayed, partial, or ambiguous actions
Verify the resulting website state independently

MCP ↔ WEBMCP CONNECTION

Accept local or remote MCP-compatible agents
Discover the WebMCP tools available on the active page
Normalize page tools into a consistent agent-facing interface
Translate only an approved MCP call into a bounded WebMCP invocation
Return structured status, results, and evidence to the agent

PLANNED GUARD MCP SURFACE

webmcp_list_toolswebmcp_inspect_toolwebmcp_invoke_toolwebmcp_get_execution_statuswebmcp_cancel_executionwebmcp_verify_resultwebmcp_get_audit_log

Keep one enforcement path. The connected agent should not also receive unrestricted browser automation. A second path could bypass Guard’s inspection, policy, and consent.

What Guard reduces

Security for the whole agent-to-browser path.

Guard combines local policy, explicit consent, bounded execution, and independent verification. It reduces risk; it does not claim to eliminate prompt injection or guarantee universal enforcement.

Untrusted influence

Separate the user’s intent from tool descriptions, page content, and returned output.

Authenticated-session abuse

Keep cookies, sessions, and browser authority behind user-owned policy and trusted consent.

Misleading behavior

Compare what a tool declares with its arguments, consequences, and verified outcome.

Data and origin leakage

Limit personal fields, permitted origins, and cross-site context to the approved task.

Replay or false success

Track execution identity and independently check for duplicate, partial, or ambiguous effects.

Agent overreach

Attribute each session and avoid parallel browser-control paths that could bypass Guard.

Guard Inspector · Developer Preview

Inspect a definition before an agent trusts it.

Paste one WebMCP tool definition. Deterministic checks run entirely in this browser tab and produce an exportable audit report.

Nothing pasted here is uploaded.

BASELINE RESULT

Low

0 findings

No baseline warnings were found.

Baseline checks passed

Continue with implementation review and real outcome testing.

Review the hardened example

{
  "name": "search_products",
  "description": "Search the public product catalog by query.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "query": {
        "type": "string",
        "maxLength": 120,
        "description": "Product words to search for."
      }
    },
    "required": [
      "query"
    ],
    "additionalProperties": false
  },
  "annotations": {
    "readOnlyHint": true,
    "untrustedContentHint": true,
    "consequentialHint": false
  },
  "exposedTo": [
    "https://northstar.example"
  ]
}

Heuristic analysis cannot prove that a tool or its implementation is safe.

Status, without fog

Working baseline. Larger boundary ahead.

The Inspector does not make the entire Guard platform available. Each connection, policy, execution, and verification layer keeps its own status.

WORKING NOW

Developer Preview

Local tool-definition inspection
Annotation checks
Sensitive-parameter warnings
Origin-exposure warnings
Consequential-action classification
Prompt-injection heuristics
Exportable audit report

BUILDING

In development

WebMCPify Guard runtime
Browser extension
MCP-to-WebMCP connection layer
WebMCP discovery and normalization
Per-agent and per-site allow, ask, and block policies
Trusted consequential-action confirmation
Origin and data-scope controls
Untrusted-output quarantine
Replay-aware execution
Local audit history
Independent post-action verification
Search reputation signals

DIRECTION

Future

Scoped capability leases
Agent identity and revocation
Replay protection
Encrypted personal-data controls
Organization policies
Threat-intelligence updates
Deeper browser-native integration

Guard protects calls routed through its user-controlled runtime. It cannot govern actions sent through a separate unrestricted browser or automation path. Universal enforcement requires cooperation from the browser or agent platform.

Public commitments

Reduces risk through layered controls.

Guard is designed to stay useful without quietly becoming another source of browser authority.

01Local-first analysis

02Minimal permissions requested only when needed

03No sale of browsing history

04No remote executable code

05No silent consequential execution

06Clear origin and agent identity

07Sensitive argument redaction in logs

08Configurable retention

09Signed, auditable releases

10Private browsing off by default