Skip to content

feat: WebMCP tools (@profullstack/webmcp) - #312

Merged
ralyodio merged 1 commit into
masterfrom
feat/webmcp
Nov 11, 2026
Merged

ralyodio merged 1 commit into
masterfrom
feat/webmcp

Conversation

@ralyodio

Copy link
Copy Markdown
Collaborator

Adds the @profullstack/webmcp embed to the root layout so c0mpute.com has the fleet-standard site_info and open_page (chat, market, nodes, apps, plugins, pricing, docs, status) alongside the existing c0mpute_* tools from WebMcpProvider.

  • /api/mcp accepts bearer c0k_ keys only (no cookies, on purpose), so it is not bridged.
  • No CSP header on the site, nothing to change.

🤖 Generated with Claude Code

site_info and open_page from the house embed, beside the c0mpute_*
tools WebMcpProvider already registers. /api/mcp is bearer-only, so
it is not bridged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio

Copy link
Copy Markdown
Collaborator Author

Merging without the Actions run: every profullstack workflow has sat in queued since ~07:53 UTC today (no runner picks anything up, org-wide). Local checks on this branch: layout-only change (data-* attributes), reviewed. The change only adds the WebMCP embed/attributes; a failed build on dev2 leaves the running stack in place. (riotcoder)

@ralyodio
ralyodio merged commit 8f66edf into master Nov 11, 2026
10 checks passed
@ralyodio
ralyodio deleted the feat/webmcp branch November 11, 2026 08:26
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

14 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 9 | LOW: 4

Severity Rule Location
HIGH js-ssrf-outbound-request apps/web/public/sw.js:24
MEDIUM js-unescaped-html-sink apps/web/src/app/blog/[slug]/page.tsx:53
MEDIUM js-unescaped-html-sink apps/web/src/app/layout.tsx:109
MEDIUM sql-template-interpolation apps/web/src/lib/chat/push.ts:476
MEDIUM sh-remote-script-execution scripts/dev-setup.sh:25
MEDIUM sh-eval-expansion scripts/dev-setup.sh:35
MEDIUM sh-remote-script-execution scripts/install.sh:185
MEDIUM sh-remote-script-execution scripts/install.sh:210
MEDIUM sh-remote-script-execution scripts/install.sh:408
MEDIUM sh-remote-script-execution scripts/install.sh:450
LOW py-ssrf-outbound-request examples/business-strategist-agent/chat.py:37
LOW py-ssrf-outbound-request examples/business-strategist-agent/train.py:54
LOW secret-generic-credential node/crates/c0mpute-core/src/webhook.rs:1171
LOW py-path-traversal node/crates/c0mpute-core/tests/fixtures/fake-infernet-text:29

Snippets are redacted; ThreatCrush never prints matched credential material.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant