Create, review, test, and verify WebMCP capabilities from a local CLI or MCP server.
Five tools with explicit schemas and descriptions, but quality is uneven. Tool names follow verb_noun convention (analyze_, generate_, audit_, apply_, test_) which is good. However, descriptions are terse (10-20 chars for some), parameter descriptions are sparse or missing, and output schemas are not documented. analyze_repository and generate_webmcp have reasonable descriptions; audit_webmcp_security and apply_webmcp lack detail on what 'security gaps' means and what 'approved' entails. No parameter descriptions visible for most tools. Error handling and recovery guidance absent. Schemas present but minimal, no output structure documented anywhere.
Analyze a local web application using WebMCPify discovery.
Apply the explicitly approved pending WebMCP patch, including the existing build check.
Audit proposed or approved WebMCP tools for access-control, quota, origin, privacy, and replay-protection gaps.
Draft WebMCP registrations through WebMCPify's existing generation pipeline. Changes remain pending review.
Run WebMCPify's existing isolated browser test and evaluation pipeline against an already-running site.
Parameter descriptions missing or minimal. 'repositoryPath' appears in all tools but has no description explaining what 'relative to workspace' means or how absolute paths are resolved. 'strict' in audit_webmcp_security has no description. 'patchIdentifier' in apply_webmcp lacks detail on format or how to obtain it.
Output schemas not documented. No tool declares what fields it returns, what structure the response has, or what an LLM should expect. This forces agents to guess and wastes tokens on unstructured parsing.
apply_webmcp is irreversible (WRITE risk) but has no confirmation or dry-run pattern. Agents can apply patches without review, risking unintended code changes. No error recovery guidance if apply fails mid-way.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 55 | 2025-06-18+ | v2 |
Vague descriptions for audit_webmcp_security and apply_webmcp. 'Audit proposed or approved WebMCP tools for access-control, quota, origin, privacy, and replay-protection gaps' does not explain what 'gaps' means, what the output is, or how to interpret results. 'Apply the explicitly approved pending WebMCP patch' does not clarify what 'approved' means or by whom.
generate_webmcp 'analysis' parameter is optional and typed as 'object' with no schema. LLMs cannot infer what fields this object should contain or how it relates to analyze_repository output. No guidance on when to pass it vs omit it.