Add webmcp gen skill

.claude-plugin/marketplace.json

@@ -83,6 +83,21 @@
       "skills": [
         "./skills/safe-browser"
       ]
+    },
+    {
+      "name": "webmcp-gen",
+      "source": "./",
+      "description": "Author, compile, and validate site-specific WebMCP init scripts from a target URL and desired tool capability.",
+      "version": "0.0.1",
+      "author": {
+        "name": "Browserbase"
+      },
+      "category": "automation",
+      "keywords": ["webmcp", "stagehand", "browser", "automation", "tool-generation", "chrome-devtools"],
+      "strict": false,
+      "skills": [
+        "./skills/webmcp-gen"
+      ]
     }
   ]
 }

README.md

@@ -15,6 +15,7 @@ This plugin includes the following skills (see `skills/` for details):
 | [browser-to-api](skills/browser-to-api/SKILL.md) | Turn a website's observable HTTP traffic into a best-effort OpenAPI 3.1 spec by analyzing a `browser-trace` capture |
 | [autobrowse](skills/autobrowse/SKILL.md) | Self-improving browser automation — iteratively runs a browsing task, reads the trace, and improves the navigation skill until it reliably passes |
 | [safe-browser](skills/safe-browser/SKILL.md) | Build local Claude Agent SDK browser agents whose only browser capability is a CDP-gated `safe_browser` tool with domain allowlist enforcement |
+| [webmcp-gen](skills/webmcp-gen/SKILL.md) | Author, compile, and validate site-specific WebMCP init scripts with the Stagehand WebMCP runtime |
 | [cookie-sync](skills/cookie-sync/SKILL.md) | Sync cookies from local Chrome to a Browserbase persistent context so the browse CLI can access authenticated sites |
 | [fetch](skills/fetch/SKILL.md) | Fetch HTML or JSON from static pages without a browser session — inspect status codes, headers, follow redirects |
 | [search](skills/search/SKILL.md) | Search the web and return structured results (titles, URLs, metadata) without a browser session |

skills/webmcp-gen/.gitignore

@@ -0,0 +1,4 @@
+node_modules/
+artifacts/
+*.log
+.DS_Store

skills/webmcp-gen/LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Browserbase, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

skills/webmcp-gen/SKILL.md

@@ -0,0 +1,135 @@
+---
+name: webmcp-gen
+description: Create, compile, and validate site-specific WebMCP init scripts from a target URL and desired tool capability. Use when the user wants to author WebMCP tools for a website, produce a webmcp.init.js artifact, or test WebMCP registration and invocation through Stagehand.
+compatibility: "Requires Node 18+ and Chrome/Chromium with WebMCP testing flags. Run `pnpm install` in the skill directory to install the Stagehand dependency. Page exploration uses the browse CLI (`npm install -g browse`)."
+license: MIT
+allowed-tools: Bash Read Grep Edit Write
+---
+
+# WebMCP Gen
+
+Author website-specific WebMCP tools by writing a manifest, compiling it to an init script, and validating that Chrome registers and invokes the tools.
+
+This skill does not call a nested agent. You are responsible for exploring the page, writing `manifest.json`, and iterating based on validation output.
+
+## Setup check
+
+From the skill directory, install the Stagehand dependency if it is not already installed:
+
+```bash
+cd skills/webmcp-gen
+pnpm install
+```
+
+The skill's `package.json` points at the published Stagehand package:
+
+```text
+@browserbasehq/stagehand
+```
+
+## Workflow
+
+1. Pick an artifact slug with exactly one slash:
+
+```text
+<domain>/<task>
+```
+
+Example:
+
+```text
+example.com/page-context
+```
+
+2. Scaffold the artifact:
+
+```bash
+node scripts/scaffold.mjs example.com/page-context --url https://example.com
+```
+
+3. Explore the target page with the `browse` CLI:
+
+```bash
+browse open https://example.com --local
+browse snapshot
+browse get title
+browse get url
+browse get text body
+browse get html body
+```
+
+Prefer `browse snapshot`, page text, and DOM inspection over screenshots unless visual layout matters. Use `browse stop` when exploration is complete.
+
+4. Edit `artifacts/<domain>/<task>/manifest.json`. The manifest is the source of truth.
+
+5. Compile:
+
+```bash
+node scripts/compile.mjs artifacts/example.com/page-context
+```
+
+6. Generate a runnable Stagehand example:
+
+```bash
+node scripts/generate-stagehand-example.mjs artifacts/example.com/page-context
+```
+
+7. Validate:
+
+```bash
+node scripts/validate.mjs artifacts/example.com/page-context
+```
+
+8. If validation fails, inspect `eval.json` and `eval-report.md`, patch `manifest.json`, then compile and validate again.
+
+## Manifest contract
+
+```json
+{
+  "domain": "example.com",
+  "task": "page-context",
+  "url": "https://example.com",
+  "generatedAt": "2026-06-04T00:00:00.000Z",
+  "tools": [
+    {
+      "name": "example_com_page_context",
+      "description": "Returns page context.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {},
+        "required": []
+      },
+      "implementation": {
+        "kind": "dom",
+        "source": "return { success: true, title: document.title, url: location.href };"
+      },
+      "fixtureInput": {}
+    }
+  ]
+}
+```
+
+## Authoring rules
+
+- `implementation.source` is inserted inside `async (input) => { ... }`; write JavaScript statements, not a full function wrapper.
+- Return a JSON-serializable object.
+- WebMCP code runs inside the browser page. Use browser-native APIs: `document`, `location`, `navigator`, and same-origin `fetch`.
+- Do not use Playwright, Puppeteer, Stagehand, XPath helpers, or agent/browser commands inside `implementation.source`.
+- `document.querySelector` and `querySelectorAll` must receive valid browser CSS selectors only.
+- To find visible text, use `Array.from(document.querySelectorAll(...)).find((el) => (el.textContent || "").includes("..."))`.
+- Do not include API keys, bearer tokens, cookies, localStorage secrets, or user credentials.
+- Do not use `eval` or `new Function`.
+- Avoid destructive actions unless the user explicitly asked for them.
+- Make implementations defensive: check for missing elements and return structured `{ success: false, error: "..." }` responses.
+- Generated init scripts register WebMCP tools only in the top frame.
+
+## Output layout
+
+```text
+artifacts/<domain>/<task>/
+  manifest.json
+  webmcp.init.js
+  stagehand-example.mjs
+  eval.json
+  eval-report.md
+```

skills/webmcp-gen/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "webmcp-gen-skill",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@browserbasehq/stagehand": "3.6.0-alpha-fd42e65bb84825bdb7341a4953472db1ff774989"
+  }
+}