WebMCP Lets AI Agents Interact With Websites via Structured Browser Tools

·4 views

WebMCP is a draft W3C standard, backed by Google and Microsoft, that allows AI agents to interact with websites through declared, structured tools rather than guessing at page elements. It shipped as an early preview in Chrome 146, with the entry point accessible via document.modelContext in the browser. Developers can implement it either declaratively by adding attributes to existing HTML forms, or programmatically by registering tools with JavaScript using a feature-detection shim. Each tool requires a name, a description for the agent, and an input schema, and executes within the user's own browser session using their existing permissions. Security guidance emphasizes least-privilege exposure, treating tool inputs as untrusted, and adding confirmation steps before any destructive actions such as deletions or payments.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Study: WebP at Quality 80–85 Beats High-JPEG Settings for Photos

A compression study tested 24 images from the standard Kodak reference suite, encoding each as JPEG and WebP across quality levels 20 to 95 and scoring results using the SSIM structural similarity metric. The findings show that most perceptible quality is gained early in the compression curve, with diminishing returns at higher settings — raising JPEG quality from 85 to 95 nearly doubles file size for an SSIM improvement of just 0.025. WebP consistently outperformed JPEG, delivering roughly 30% smaller files at equivalent perceived quality. Lossless formats cost approximately seven times the size of a quality-85 JPEG, making them impractical for most photographic use cases. Researchers recommend quality 80–85 in WebP as the practical sweet spot, while noting that the ideal setting varies by image content and is best determined through live preview rather than a fixed number.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MCP Solves AI Tool Discovery But Leaves Security Gaps for Developers to Fill

The Model Context Protocol (MCP) has standardized how AI clients discover and invoke external tools, replacing fragmented, custom plugin systems with a common language. However, security experts warn that discoverability is not the same as authorization — a tool being listed does not mean it is safe or permitted to use. MCP does not natively enforce per-user permissions, least-privilege access, sandboxing, prompt-injection defenses, or approval workflows. Every tool description, schema, and result enters the AI model's context, making them potential attack surfaces for manipulation. Developers are advised to treat MCP servers as runtime plugins with real influence and to implement a dedicated policy gateway between agents and MCP servers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

hls.js ESM builds skip the transmuxer worker by default, here is how to fix it

The ESM build of hls.js, introduced in version 1.4, does not bundle the transmuxer worker inline, meaning video transmuxing runs on the main thread unless a workerPath is explicitly configured. The default enableWorker: true setting is misleading, as it only signals intent to use a worker if available rather than confirming one is actually running. Developers can verify whether a worker is active by checking the browser's resource performance entries or the DevTools thread panel during playback. The fix involves passing a resolved URL for hls.worker.js via the workerPath option, with syntax varying slightly across bundlers such as Vite, webpack 5, and Next.js. Additionally, a PerformanceObserver tracking long tasks exceeding 50ms can help distinguish main-thread stalls from network-related buffering issues.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a React Native Video Upload That Survives App Backgrounding

A standard fetch() upload in React Native fails silently when the OS suspends or kills the app mid-transfer, leaving no error and no settled promise. To work around this, developers can persist upload state in a SQLite database and use a native background session — iOS Background URLSession and an Android foreground service — to handle the actual file transfer. The approach requires writing the file body to disk first, since iOS background sessions do not support in-memory data or stream bodies. On Android, targeting version 14 and above requires declaring a dataSync foreground service type, while Android 15 introduces a 6-hour daily cap on such services. The full implementation, written against Expo SDK 54 and SDK 55, runs to roughly 150 lines and reconciles upload state with the server when the app returns to the foreground.

0 comments Read more at DEV Community