# WebMCP Today (npm · @webmcp-today/mcp-bridge)

Your agent gets trustworthy tools on sites without WebMCP — data-only packages you approve.

- Trust score: 91/100 (high trust)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-21

## Components

- npm · `@webmcp-today/mcp-bridge`: 91/100 (this document), [markdown](https://verifymcp.io/servers/robertn702-webmcp-today/webmcp-today-mcp-bridge.md), [page](https://verifymcp.io/servers/robertn702-webmcp-today/webmcp-today-mcp-bridge)

## Channel facts

- Registry: `npm`
- Package: `@webmcp-today/mcp-bridge`
- Version: `0.3.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-21.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 31 of 99 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to robertn702/webmcp-today).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 24 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 78/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1227 tokens (~72/item across 17 items; 17 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 83/100
  - Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 88/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 63% of tool parameters carry a description.
- **Tool Safety**: 75/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 0 of 5 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "publish_package" implies "publish" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.
  - An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the WebMCP Today MCP server?

WebMCP Today runs locally as an npm package, launched with npx -y @webmcp-today/mcp-bridge. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add robertn702-webmcp-today -- npx -y @webmcp-today/mcp-bridge
```

### Cursor

```json
{
  "mcpServers": {
    "robertn702-webmcp-today": {
      "command": "npx",
      "args": [
        "-y",
        "@webmcp-today/mcp-bridge"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "robertn702-webmcp-today": {
      "command": "npx",
      "args": [
        "-y",
        "@webmcp-today/mcp-bridge"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add robertn702-webmcp-today -- npx -y @webmcp-today/mcp-bridge
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "robertn702-webmcp-today": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@webmcp-today/mcp-bridge"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add robertn702-webmcp-today --command npx --arg -y --arg @webmcp-today/mcp-bridge
```

### Hermes

```yaml
mcp_servers:
  robertn702-webmcp-today:
    command: "npx"
    args: ["-y", "@webmcp-today/mcp-bridge"]
```

### Netclaw

```json
{
  "McpServers": {
    "robertn702-webmcp-today": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@webmcp-today/mcp-bridge"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add robertn702-webmcp-today -t stdio -c npx -a -y @webmcp-today/mcp-bridge
```

### Other

```json
{
  "mcpServers": {
    "robertn702-webmcp-today": {
      "command": "npx",
      "args": [
        "-y",
        "@webmcp-today/mcp-bridge"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-21 (score 91, +1)

No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-19 (score 90, +1)

No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-17 (score 89, +1)

No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-15 (score 88, +1)

No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-13 (score 87, +1)

No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-10 (score 86, +1)

No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-08 (score 85, +1)

No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-06 (score 84, +1)

No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (17)

### `lookup_package` (~59 tokens)

Look up WebMCP packages for a page URL, at each package's latest version. Returns matches most-specific-pattern first.

Input parameters:

- `url` (string, required): Full page URL, e.g. https://news.ycombinator.com/item?id=1

### `list_packages` (~55 tokens)

Browse registry packages with pagination and optional domain filter (each at its latest version).

Input parameters:

- `domain` (string): Filter by domain, e.g. github.com
- `page` (integer)
- `pageSize` (integer)

### `get_package` (~29 tokens)

Get a single package by id, at its latest version.

Input parameters:

- `id` (string, required): Package id

### `list_installs` (~28 tokens)

List the caller's installed packages, each pinned to its installed version. Requires an API key.

### `get_stats` (~20 tokens)

Registry stats: total packages, domains covered, top domains.

### `publish_package` (~56 tokens)

Publish a new WebMCP package to the registry as a fresh package whose version field must declare 1 (validated against @webmcp-today/schema). Requires an API key.

Input parameters:

- `package` (object, required): The package to publish

### `update_package_meta` (~67 tokens)

Update a package's metadata (title, description) — owner only. Domain is immutable and never touches urlPatterns/tools/minEngine; use publish_package_version for that. Requires an API key.

Input parameters:

- `id` (string, required): Package id
- `meta` (object, required): Metadata fields to change

### `publish_package_version` (~139 tokens)

Publish the next version of a package you contributed (urlPatterns, tools, required api and minEngine, optional changelog) — owner only, append-only. The version field is author-declared and must equal the current latest version + 1 exactly (query the package first to see it); a 409 response returns the expectedVersion to declare on retry. Installed users stay pinned until they move their install pin. Requires an API key.

Input parameters:

- `id` (string, required): Package id
- `version` (object, required): The new version's declared version number (latest + 1), urlPatterns, tools, api, minEngine, optional changelog

### `install_package` (~109 tokens)

Pin a package to its latest version, or a given versionId, on your webmcp.today account — creates the pin if absent, moves it if present (also how rollback works: pass an older versionId). This does not install into your browser; the extension's installs are local to the browser. Returns a link that installs this exact version there. Requires an API key.

Input parameters:

- `id` (string, required): Package id
- `versionId` (string): Pin to this version instead of latest

### `uninstall_package` (~49 tokens)

Remove the caller's install pin on your webmcp.today account. This does not affect the extension's local install in your browser. Requires an API key.

Input parameters:

- `id` (string, required): Package id

### `list_connected_webmcp_tabs` (~53 tokens)

List all Chrome/Brave tabs with reachable WebMCP tools: the user's selected tab plus tabs matching installed packages. Use focus_webmcp_tab with a tabId from this list to switch targets.

### `focus_webmcp_tab` (~63 tokens)

Focus a connected tab, making it the selected target for list_webmcp_tools and execute_webmcp_tool. Use a tabId from list_connected_webmcp_tabs.

Input parameters:

- `tabId` (integer, required): Tab id from list_connected_webmcp_tabs

### `list_webmcp_tools` (~85 tokens)

List live WebMCP tools in the user-selected active visible Chrome/Brave tab. Returns a document and tool-list generation required by execute_webmcp_tool. If the tab is not eligible or available, call focus_webmcp_tab with the target tabId, then retry.

Input parameters:

- `tabId` (integer, required): Tab id from list_connected_webmcp_tabs

### `execute_webmcp_tool` (~175 tokens)

Execute one live WebMCP tool in the user-selected active visible Chrome/Brave tab. Use the tab and generation values from list_webmcp_tools. If execution fails because the tab is not eligible or available, call focus_webmcp_tab with the target tabId, then retry. Registry-injected package tools retain their existing confirmation behavior. An execution-timeout error means the call may still have run - verify its effect before retrying. A dispatch-failed error confirms that the call did not run and can be retried.

Input parameters:

- `documentGeneration` (string, required)
- `input` (object, required): JSON object passed to the WebMCP tool
- `tabId` (integer, required)
- `toolName` (string, required)
- `toolOrigin` (string, required)
- `toolsGeneration` (string, required)

### `setup_webmcp_bridge` (~109 tokens)

Install the first-party WebMCP Today native bridge for macOS Chrome or Brave. This copies a fixed bundled host to ~/.config/webmcp-today and writes only this bridge's native-messaging manifest under ~/Library/Application Support. Set confirm to true to approve these writes.

Input parameters:

- `browser` (string)
- `confirm` (boolean): Must be true to approve the bridge installation.
- `extensionId` (string): Development-only override. Public setup otherwise uses the official release ID.

### `get_webmcp_bridge_status` (~49 tokens)

Inspect the macOS Chrome or Brave WebMCP Today bridge installation without changing files. Reports bridge-owned paths and permissions but never returns the bridge secret.

Input parameters:

- `browser` (string)

### `uninstall_webmcp_bridge` (~82 tokens)

Remove WebMCP Today's macOS native-messaging bridge artifacts for Chrome or Brave. Brave retains Chrome's compatibility manifest because Brave may use it; the result reports that residual and the required follow-up Chrome uninstall. Set confirm to true to approve removal.

Input parameters:

- `browser` (string)
- `confirm` (boolean): Must be true to approve bridge removal.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/robertn702-webmcp-today/webmcp-today-mcp-bridge#diagnostics

## Score history

- 2026-09-21: 91
- 2026-09-20: 90
- 2026-09-19: 90
- 2026-09-18: 89
- 2026-09-17: 89
- 2026-09-16: 88
- 2026-09-15: 88
- 2026-09-14: 87
- 2026-09-13: 87
- 2026-09-12: 86
- 2026-09-11: 86
- 2026-09-10: 86
- 2026-09-09: 85
- 2026-09-08: 85
- 2026-09-07: 84
- 2026-09-06: 84
- 2026-09-05: 83
- 2026-09-04: 79
- 2026-09-03: 79
- 2026-09-02: 79
- 2026-09-01: 79
- 2026-08-31: 79
- 2026-08-30: 79
- 2026-08-29: 79
- 2026-08-28: 79
- 2026-08-27: 64

## Common questions

### What is the WebMCP Today MCP server?

WebMCP Today is an MCP server listed in the public MCP registry as io.github.robertn702/webmcp-today. Your agent gets trustworthy tools on sites without WebMCP, data-only packages you approve. This page covers its npm package (@webmcp-today/mcp-bridge).

### Is the WebMCP Today MCP server safe to use?

WebMCP Today scores 91 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the WebMCP Today MCP server expose?

WebMCP Today exposes 17 tools: lookup_package, list_packages, get_package, list_installs, get_stats, and 12 more. Their descriptions and schemas cost roughly 1,227 tokens of context every time the server is loaded.

### Is the WebMCP Today MCP server still maintained?

WebMCP Today is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the WebMCP Today MCP server under?

WebMCP Today declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/@webmcp-today/mcp-bridge
- Socket report: https://socket.dev/npm/package/@webmcp-today/mcp-bridge
- Repository: https://github.com/robertn702/webmcp-today
- Website: https://webmcp.today/
- Changelog RSS feed: https://verifymcp.io/servers/robertn702-webmcp-today/webmcp-today-mcp-bridge.xml
- Changelog JSON feed: https://verifymcp.io/servers/robertn702-webmcp-today/webmcp-today-mcp-bridge.json
- HTML version of this page: https://verifymcp.io/servers/robertn702-webmcp-today/webmcp-today-mcp-bridge