Skip to content

Stage 1 · Developer playground

WebMCP sandbox

This is the Stage 2 host's request path, reimplemented in the browser. Nothing is sent anywhere — no network call, no storage, no account. Edit the payload, send it, and watch which stage rejects it and why.

JSON-RPC 2.0 request
Host trace2 tools registered

Press Send to host to trace the request through parse → envelope → schema → firewall → sandbox → settlement.

WebMCP declarationProposal — not yet a shipped browser API
// Declare a capability so an agent can call it directly,
// instead of guessing at your DOM.
navigator.modelContext.registerTool({
  name: "memory_search",
  description: "Search connected memory networks.",
  inputSchema: {
    type: "object",
    properties: {
      query: { type: "string" },
      scope: { type: "string", enum: ["sovereign", "non-sovereign", "both"] },
      limit: { type: "integer" }
    },
    required: ["query"]
  },
  async execute({ query, scope, limit }) {
    const spans = await ai4all.route({ query, scope, limit });
    return { content: [{ type: "text", text: JSON.stringify(spans) }] };
  }
});

What each stage is for

Order matters. Cheap structural checks run before expensive ones, and every check runs before anything is spawned — because once a runtime exists, the blast radius exists with it.

parse
Bytes to JSON. A failure here is -32700 and nothing else runs.
envelope
jsonrpc must be "2.0"; method must exist; a missing id makes it a notification.
schema
Arguments are checked against the tool's declared inputSchema before inspection.
pxf
Seven rule families: traversal, chaining, substitution, env exfiltration, SQL pollution, prompt injection, remote payloads.
sandbox
Only now would a runtime be spawned — read-only rootfs, ephemeral scratch.
settle
A receipt is derived from the call and returned in the response metadata.

Honest limits of this sandbox

  • It simulates. No tool actually executes, no memory network is contacted, and the settlement receipt is a SHA-256 digest of your request — not a real TODA/IP transfer.
  • The denylist is illustrative. Pattern matching catches known shapes and misses novel ones. A production firewall pairs it with positive schema validation, allow-listed argument shapes, and never handing arguments to a shell.
  • navigator.modelContext is a proposal. WebMCP is in-progress standards work, not a broadly shipped browser API. The snippet shows the shape we are building toward.