WebMCP Proposes Structured Tool API to Help AI Agents Navigate Web Apps

·3 views

WebMCP is a proposed web standard that allows web pages to explicitly expose named, callable tools to AI browser agents, rather than forcing agents to infer actions by simulating clicks and keystrokes. Current browser agents are prone to errors when UI elements shift, labels are ambiguous, or workflows span multiple screens. Under WebMCP, a page registers tools with defined names, input schemas, and execution functions that align with the page's current state and lifecycle. The application retains full control over authorization, validation, and business logic, and the agent only accesses capabilities the page chooses to expose at any given moment. WebMCP offers both a declarative HTML-form-based API and an imperative JavaScript API to suit static and dynamic application needs respectively.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Stack Overflow's Slow Decline Predates the AI Era, One Engineer's Data Shows

A software engineer who built his debugging skills by answering questions on Stack Overflow between 2018 and 2024 has shared data showing his own activity collapsed well before AI tools like ChatGPT arrived. His annual answer count dropped from 150 in 2018 to just 3 by 2022, while the platform itself was still receiving over a million questions per year. The engineer argues the site's real turning point came around 2014, when Stack Overflow began aggressively closing questions for quality violations, discouraging new users from engaging. A 2022 study found roughly half of new-user posts received a closure, no answer, or an unexplained downvote, effectively stripping the platform of the human interaction that once made it valuable. By systematically eliminating conversation and context, the site inadvertently created the ideal conditions for an AI tool to replace it entirely.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

One Git Repo Can Replace Jira, Confluence, and TestRail for Traceability

A software development pattern proposes storing tickets, wiki pages, test cases, and test runs as YAML files within a single Git repository, eliminating the need for multiple SaaS tools. The approach uses consistent file-based IDs — such as AUTH-102.yaml for tickets and W-XXXXXX.yaml for wiki pages — so that linking between artifacts means opening a local file rather than calling external APIs. Inline wiki-style references like [[AUTH-102]] or [[wiki:W-ABC123]] can be embedded in any Markdown body, with unresolved links visually flagged before changes are synced. Because all data lives on disk, search, related-item lookups, and navigation work offline and behave like switching files in an IDE. The trade-off is that it forgoes automatic bi-directional sync with tools like Jira, but gains a reviewable, grep-able graph that requires no account or login to browse.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Model Security Training Must Address Checkpoint Deserialization Risks

Most AI security training focuses on prompt injection and jailbreaks but overlooks a more fundamental threat: malicious code hidden inside model checkpoint files. PyTorch's .pt and .bin files contain Python pickle archives that execute arbitrary code when loaded, a vulnerability class known as CWE-502 deserialization of untrusted data. CVE-2025-24357 demonstrated this risk in vLLM, where checkpoints downloaded from a model hub were loaded without the weights_only=True safeguard, enabling remote code execution on the inference host. A parallel flaw, CVE-2024-11393, affected Hugging Face Transformers with a CVSS score of 8.8, reached through MaskFormer model file parsing. Security teams are advised to inspect checkpoint files using tools like pickletools and fickling, adopt safer formats such as safetensors, and mirror approved models into internal registries pinned by digest rather than pulling directly from public hubs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Handle Browser File Uploads Without Exposing Your API Key

Storing API keys in the browser is a security risk, as client-side code can be inspected and credentials copied by anyone. A safer approach involves the server generating a short-lived, scoped upload link using the API key, then passing only that link to the browser. The browser never sees the actual API key; it simply redirects the user to a hosted upload page via the temporary URL. Developers can enforce restrictions on the link, such as allowed file types, size limits, file count, and expiry duration. This pattern is suited for workflows like support forms, job applications, and document collection where users need to submit files securely.

0 comments Read more at DEV Community