Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WebMCP is available for early preview

developer.chrome.com

Post reply on HN
Print view View original

181–190 of 226 posts

Re: WebMCP is available for early preview

#181

Post by bryanlarsen »

drusepth wrote: post #89
bryanlarsen wrote: post #87

Earlier quoted context omitted.

It's a failed technology for websites.

How is it failed? Just compared to, like, the prevalence of HTML? I've worked in web dev for almost 20 years. Almost every year has had some kind of work with XML.

Client side? i think not. 25 years ago we were told web sites were going to make their data available in nice machine readable XML form which would be transformed by xslt etc into presentation form and available for machine use without the presentation form. Same promise as semantic HTML but earlier, and same promise as webmcp now.

Re: WebMCP is available for early preview

#182

Post by wraptile »

cameldrv wrote: post #38
akersten wrote: post #36

Earlier quoted context omitted.

I'm old enough to remember discussions around the meaning of `User-Agent` and why it was important that we include it in HTTP headers. Back before it was locked to `Chromium (Gecko; Mozilla 4.0/NetScape; 147.01 ...)`. We talked about a magical future where your PDA, car, or autonomous toaster could be browsing the web on your behalf, and consuming (or not consuming) the delivered HTML as necessary. Back when we named…

Me too but it died when ads became the currency of the web. If the reason the site exists is to use ads, they’re not going to let you use an user agent that doesn’t display the ads.

Not only ads. Primary anti-scraping use today is obfuscation either as anti-competitive practice or hiding unlawful behavior like IP infringement etc.

Re: WebMCP is available for early preview

#183

Post by andai »

WhiteDawn wrote: post #138
onion2k wrote: post #126

Earlier quoted context omitted.

My first thought was that you could just obfuscate the code and that would stop the LLM. So I tried. I put the following into ChatGPT 5.3: What does this JavaScript do? function _0x2dee(_0x518715,_0xdc9c42){_0x518715=_0x518715-(0x639+0x829+-0x332*0x4);var _0x4f9ec2=_0x1aec();var _0x2308f2=_0x4f9ec2[_0x518715];return _0x2308f2;}var _0xbdf4ac=_0x2dee;function _0x1aec(){var _0x472dbe=['65443zxmXfN','71183WPtagF','168716…

I’ve used AI for some reverse engineering and I’ve noticed the same thing. It’s generally great at breaking obfuscation or understanding raw decompilation. It’s terrible at confirming prior work, if I label something incorrectly it will use that as if it was gospel. Having a very clean function with lots of comments and well named functions with a lot of detail that does something completely different will trip it up…

> It’s terrible at confirming prior work, if I label something incorrectly it will use that as if it was gospel.

That's funny, sounds like you'd get better results by obfuscating then. (Relative to partially deobfuscated code that might have incorrect names.)

Re: WebMCP is available for early preview

#184

Post by yuvrajangads »

I've been using MCP with Claude Code for a while now (Google Maps, Swiggy, Figma servers) and the local tool-use model works well because I control both sides. I pick which servers to trust, I see every tool call, and I can deny anything sketchy.

WebMCP flips that. The website exposes the tools and the browser decides what to call. The security model gets a lot harder when you're trusting random sites to define their own tool interfaces honestly. A malicious site could expose tools that look helpful but exfiltrate context from the agent's session.

Curious how they plan to sandbox this. The local MCP model works because trust is explicit. Not sure how that translates to the open web.

Re: WebMCP is available for early preview

#186

Post by MadnessASAP »

qalmakka wrote: post #153
onion2k wrote: post #126

Earlier quoted context omitted.

My first thought was that you could just obfuscate the code and that would stop the LLM. So I tried. I put the following into ChatGPT 5.3: What does this JavaScript do? function _0x2dee(_0x518715,_0xdc9c42){_0x518715=_0x518715-(0x639+0x829+-0x332*0x4);var _0x4f9ec2=_0x1aec();var _0x2308f2=_0x4f9ec2[_0x518715];return _0x2308f2;}var _0xbdf4ac=_0x2dee;function _0x1aec(){var _0x472dbe=['65443zxmXfN','71183WPtagF','168716…

Yeah even the "basic" free tier Gemini 3.1 thinking model can easily unscramble that. It's impressive, but after all it's the very precise kind of job an LLM is great at - iteratively apply small transformations on text

It's genuinely amazing how good they are at reverse engineering.

I have a silly side project that ended up involving the decompilation of a toaster ovens firmware, the firmware of the programmer for said toaster ovens MCU, and the host side programming software. They were able to rip through them without a problem, didn't even have ghidra setup, they just made their own tools in python.

Re: WebMCP is available for early preview

#188

Post by otterley »

jauntywundrkind wrote: post #142
otterley wrote: post #114

Earlier quoted context omitted.

Explain.

WebMCP is mediated by the browser/page & has the full context of the user's active page/session available to it. Websites that do offer real APIs usually have them as fairly separate things from the web's interface. So there's this big usability gap, where what you do on the API doesn't show up clearly on the web. If the user is just hitting API endpoints unofficially, it can create even worse unexpected split brain…

The whole point of an agent, though, is to overcome obstacles to accomplish tasks on your behalf. And since an agent is a computer program, the most efficient way to accomplish tasks using computer services is though APIs. Websites are first and foremost human interfaces, not computer interfaces.

Having an agent use a browser to accomplish tasks on the principal’s behalf is a backstop. It’s for when service providers refuse to implement APIs—and they frequently refuse to do this on purpose. And I expect they will continue to make it as difficult as possible for agents to automate website-based extraction for the same reason they don’t provide APIs. If you thought Captcha solving was a nuisance already, expect it to get worse.

Re: WebMCP is available for early preview

#189

Post by MadnessASAP »

yuvrajangads wrote: post #184

I've been using MCP with Claude Code for a while now (Google Maps, Swiggy, Figma servers) and the local tool-use model works well because I control both sides. I pick which servers to trust, I see every tool call, and I can deny anything sketchy. WebMCP flips that. The website exposes the tools and the browser decides what to call. The security model gets a lot harder when you're trusting random sites to define their…

The threat model doesn't really change for agents that already have "web fetch" (or equivalent) enabled. The agent is free to communicate with untrusted websites[1]. As before, the firewall remains at what private information the agent is allowed to have.

[1] If anything the threat gets somewhat reduced by the ability to point directly at a trusted domain and say "use this site and it's (presumably) trusted tools."

Re: WebMCP is available for early preview

#190

Post by yuvrajangads »

MadnessASAP wrote: post #189
yuvrajangads wrote: post #184

I've been using MCP with Claude Code for a while now (Google Maps, Swiggy, Figma servers) and the local tool-use model works well because I control both sides. I pick which servers to trust, I see every tool call, and I can deny anything sketchy. WebMCP flips that. The website exposes the tools and the browser decides what to call. The security model gets a lot harder when you're trusting random sites to define their…

The threat model doesn't really change for agents that already have "web fetch" (or equivalent) enabled. The agent is free to communicate with untrusted websites[1]. As before, the firewall remains at what private information the agent is allowed to have. [1] If anything the threat gets somewhat reduced by the ability to point directly at a trusted domain and say "use this site and it's (presumably) trusted tools."

Fair point about web fetch already being a trust boundary. The difference I see is that web fetch returns data, but WebMCP tools can define actions. A tool called "add_to_cart" is a lot more dangerous than fetching a product page. The agent trusts the tool's name and description to decide whether to call it, and that metadata comes from the site.

But yeah, if you're already letting agents browse freely, the incremental risk might be smaller than I'm imagining.

Post reply on HN