Agent skill · browserbase
add-webmcp
Analyze an existing web application, identify safe user-visible capabilities across routes, forms, server actions, handlers, and schemas, then implement first-party WebMCP tools and validate discovery and invocation with Stagehand. Use when the user asks to make a codebase agent-ready, expose website features as WebMCP tools, or add WebMCP directly to an app rather than generating a standalone injection script from a URL.
What it needs
About 7k tokens when loaded.
What this skill does
Add WebMCP Turn capabilities already implemented by a web app into maintained, first-party WebMCP tools. Modify the target codebase and its tests; do not introduce a hosted proxy or third-party runtime. Compatibility: the bundled Stagehand validator requires Node.js 22.18 or newer. Validation needs Chrome/Chromium locally or BROWSERBASEAPIKEY for a publicly reachable preview. Be verbose as you work: report what each step found as you go, not only in the final report. Use webmcp-gen instead when the requested output is a standalone init script derived from a live URL. This skill starts from source code and integrates tools into the application. 1. Establish the application boundary Read the target repository's instructions, package manifests, framework configuration, and current git status. Preserve unrelated changes. Set ADDWEBMCPSKILLDIR to the directory containing this file and run the bounded scanner: Treat scanner results as leads, not conclusions. In a monorepo, identify the actual browser app and the server packages it calls before editing. 2. Build a capability inventory Trace each candidate from its user-visible entry point through the client handler, validation schema, server boundary, authorization checks, side effect, and returned state. Look at: routes and screens; forms and their submit handlers; server actions, API handlers, RPC procedures, and service clients; Zod, Valibot, Yup, Joi, JSON Schema, or equivalent validators; authentication, authorization, CSRF, idempotency, rate limits, and audit hooks. Prefer complete user tasks such as searchcatalog or savedraft, not a mechanical tool per endpoint. Exclude internal/admin-only operations, authentication bypasses, raw database access, secret-bearing operations, and capabilities the UI does not grant the current user. For each selected tool, record its source files, existing validation and authorization boundary, side effects, risk class, confirmation behavior, and a safe fixture input. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills browserbase/add-webmcp