Skip to content

feat: WebMCP tools (@profullstack/webmcp) - #8

Merged
ralyodio merged 1 commit into
mainfrom
feat/webmcp
Nov 11, 2026
Merged

ralyodio merged 1 commit into
mainfrom
feat/webmcp

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Adds WebMCP so an AI agent in the visitor's browser can search and inspect the OpenDisk marketplace.

  • Layout head: site_info, open_page (disks, submit, validate, serve, store, docs), search_site over /api/v1/disks?q=.
  • /webmcp-tools.js (served from the static allowlist): get_disk over /api/v1/disks/:id.
  • Forms: filter_disks and validate_disk (GET, toolautosubmit), submit_disk (fills only; the person presses the button).
  • CSP: script-src 'none' becomes script-src 'self' https://cdn.jsdelivr.net (the embed is the only script on the site).

🤖 Generated with Claude Code

Layout head embed: site_info, open_page, search_site over
/api/v1/disks, and public/webmcp-tools.js (get_disk). Filter and
validate forms are declarative autosubmit tools; the list form fills
only. CSP script-src goes from 'none' to 'self' + cdn.jsdelivr.net.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio

Copy link
Copy Markdown
Contributor Author

Merging without the Actions run: every profullstack workflow has sat in queued since ~07:53 UTC today (no runner picks anything up, org-wide). Local checks on this branch: biome check + bun test (28 pass). The change only adds the WebMCP embed/attributes; a failed build on dev2 leaves the running stack in place. (riotcoder)

@ralyodio
ralyodio merged commit eb51c8c into main Nov 11, 2026
4 checks passed
@ralyodio
ralyodio deleted the feat/webmcp branch November 11, 2026 08:26
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

1 finding(s) in the 5 file(s) this pull request changes.

MEDIUM: 1

Severity Rule Location
MEDIUM js-unescaped-html-sink src/views/Layout.jsx:96
24 pre-existing finding(s) elsewhere in the repository — **HIGH**: 4 | **MEDIUM**: 8 | **LOW**: 12

Not introduced by this pull request.

Severity Rule Location
HIGH secret-database-url .env.example:2
HIGH secret-database-url .github/workflows/ci.yml:23
HIGH secret-database-url src/config.js:27
HIGH tls-verification-disabled src/db.js:21
MEDIUM sql-template-interpolation src/db.js:76
MEDIUM sql-template-interpolation src/disks.js:83
MEDIUM sql-template-interpolation src/disks.js:86
MEDIUM sql-template-interpolation src/disks.js:168
MEDIUM sql-template-interpolation src/disks.js:179
MEDIUM sql-template-interpolation src/disks.js:269
MEDIUM sql-template-interpolation src/disks.js:270
MEDIUM sql-template-interpolation src/disks.js:341
LOW sql-template-interpolation test/announce.api.test.js:68
LOW sql-template-interpolation test/announce.api.test.js:89
LOW sql-template-interpolation test/announce.api.test.js:93
LOW sql-template-interpolation test/announce.api.test.js:97
LOW sql-template-interpolation test/api.test.js:145
LOW sql-template-interpolation test/api.test.js:149
LOW sql-template-interpolation test/api.test.js:154
LOW sql-template-interpolation test/api.test.js:158

…and 4 more; the full set is in the SARIF artifact.

Snippets are redacted; ThreatCrush never prints matched credential material.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant