feat: WebMCP Workbench Chrome side-panel extension - #24
Open
liady wants to merge 5 commits into
Open
Conversation
…on reuse - src/page-fns.ts: self-contained readToolsInPage/runToolInPage functions (injectable via chrome.scripting.executeScript world:MAIN) - src/page.ts: expression strings now derived from those functions via toString(), keeping the CDP/CLI contract identical - src/verify.ts: extract normalizeListResult/normalizeExecuteResult so the CLI and workbench extension share result handling - package.json: browser-safe ./verify and ./page-fns subpath exports Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Vite + @crxjs/vite-plugin + React MV3 extension in apps/webmcp-workbench. Reaches the page's document.modelContext by injecting the self-contained page-fns from @ora-ai/webmcp-verify via chrome.scripting.executeScript (world: MAIN) — CSP-proof, no content scripts, no eval. Inspect / Run (schema-driven forms) / Audit (lintTools) views plus a StatusBar with explicit WebMCP-not-detected guidance. build.target esnext + esbuild chrome110 keep the injected functions serializable (no helper refs). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…tures On Chrome 152 the retired feature name invalidates the whole --enable-features list, leaving WebMCP off; WebMCPTesting alone works on 151 and 152 (both verified empirically; 152 also ships WebMCP on by default). Update WEBMCP_CHROME_FLAGS, the no-modelcontext guidance, and docs to match. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…xt arg
Chrome ~151 invokes tool execute(input) with a single argument (verified
by probe); the spec-shape destructure of { signal } from a missing second
argument made both bookshop tools throw. Default the context object and
optional-chain throwIfAborted.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
scripts/e2e.mjs serves the bookshop fixture, launches Chrome with the built extension (needs a --load-extension-capable binary, e.g. Chrome for Testing; branded >=137 ignores the switch), opens the real side panel via a user-gesture eval, and drives Inspect -> Run -> Audit plus the 0-tools and WebMCP-not-detected states. 15 checks, all passing on Chrome for Testing 152. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
A new
apps/webmcp-workbenchChrome MV3 side-panel extension — a WebMCP devtools workbench that inspects a page's registered tools, runs them through schema-driven forms, and lints them with the same rules as thewebmcp-verifyCLI. No AI agent, no LLM providers — devtools only.How
packages/webmcp-verifyrefactor (additive, CDP path unchanged): newsrc/page-fns.tsholds the page logic as self-contained functions (readToolsInPage/runToolInPage);page.tsderives the CLI's CDP expression strings from them viatoString();verify.tsexportsnormalizeListResult/normalizeExecuteResult; browser-safe./verifyand./page-fnssubpath exports (the root still pulls Node-only chrome-launcher and must not enter the bundle).chrome.scripting.executeScript({world:"MAIN", func})— CSP-proof (no eval), zero content scripts, no message bridge. CLI and panel share one page contract.build.target: esnextpinned so the injected functions aren't down-leveled into unserializable helper refs.tabs+host_permissions(notactiveTab, which never applies from a side panel); background is onesetPanelBehaviorcall.Also fixed along the way (found by the E2E)
DevToolsWebMCPSupportno longer exists and its presence invalidates the whole--enable-featureslist;WebMCPTestingalone works on 151+152 (152 ships WebMCP on by default).WEBMCP_CHROME_FLAGS, guidance text, and docs updated.execute(input)with one argument; the spec-shape{ signal }destructure threw. Context param now defaults.Verification
webmcp-verify: 17/17 Vitest, lint, typecheck, build green (CDP contract tests updated to the toString-derived expressions; same safety properties).apps/webmcp-workbench/scripts/e2e.mjs, 15/15 on Chrome for Testing 152): loads the built extension, opens the real side panel via user-gesture eval, and drives Inspect (search_books + read-only badge + schema) → Run (schema form → parsed{"matches":[…]}+ raw DOMString) → Audit (clean) → 0-tools and WebMCP-not-detected states. Branded Chrome ≥137 ignores--load-extension, so the script needsCHROME_PATHpointed at Chrome for Testing (documented in the script).node scripts/check.mjsgreen; bridge tests untouched and green (13/13).Legal
Clean-room build on our own
webmcp-verifycode; informed by observing nekuda's extension behavior, no code copied. MIT.🤖 Generated with Claude Code