# Reported issues for WebMCP Today

Pod holds 9 of 9 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [WebMCP Today](/mcp/webmcp-today).

## Most discussed

### fix(schema): prevent URL patterns from exceeding visible package scope

## Problem

Published packages can currently declare global or public-suffix-style URL patterns that do not reflect the package domain shown to users. Examples include `*://*/*` and patterns such as `*://*.com/*`.

Relevant behavior:

- `packages/schema/src/url-matching.ts` accepts `*` as the entire host and treats it as covering every hostname.
- The same host-coverage logic accepts wildcard suffixes without checking whether the suffix is a public suffix or bare TLD.
- `packages/schema/src/pack

[Read the thread](https://github.com/robertn702/webmcp-today/issues/99) · 2026-08-03 · closed · 2 comments

### fix(extension): scope popup package suggestions to the active page

## Problem

The extension popup currently fetches the globally newest registry packages from `GET /api/packages?pageSize=6` whenever no installed package matches the active tab. This can show packages unrelated to the page the user is viewing, and publishing a new version moves a package into the global suggestion surface.

Relevant code:

- `apps/extension/src/lib/suggestions.ts` fetches packages without a domain filter.
- `apps/extension/src/entrypoints/background.ts` has the active tab URL/ho

[Read the thread](https://github.com/robertn702/webmcp-today/issues/98) · 2026-08-03 · closed · 1 comment

### Document bunx as an alternative to npx for the MCP bridge

The quickstart currently shows the MCP bridge configured with npx, but the prerequisites also allow Bun.

For Bun users, please document the equivalent MCP configuration using bunx, for example:

MCP configuration:
[mcp_servers.webmcp-today]
command = /Users/USERNAME/.bun/bin/bunx
args = [--yes, @webmcp-today/mcp-bridge@0.3.0]

It would also help to mention that Codex may not inherit the interactive shell PATH, so an absolute bunx path may be needed. This would make the Bun path clearer for the 

[Read the thread](https://github.com/robertn702/webmcp-today/issues/173) · 2026-08-14 · open · 0 comments

### Omit optional query parameters when placeholder input is absent

## Problem

Optional tool inputs used as query placeholders currently interpolate to an empty string when omitted. For example:

```json
{
  "query": {
    "period": "{{period}}",
    "pagination_cursor": "{{pagination_cursor}}",
    "pagination_limit": "25"
  }
}
```

When `pagination_cursor` is optional and the caller omits it, the executor sends:

```text
?period=future&pagination_cursor=&pagination_limit=25
```

rather than omitting `pagination_cursor`.

This makes common cursor-pagination A

[Read the thread](https://github.com/robertn702/webmcp-today/issues/167) · 2026-08-12 · closed · 0 comments

### Add Hacker News read tools for safe posting workflows

## Problem
The Hacker News package currently exposes `hn_submit`, `hn_get_item`, `hn_list_children`, `hn_comment`, and `hn_vote`, but it cannot safely perform the required pre-write checks for an automated posting workflow.

## Requested tools

### `hn_find_submissions`
Add a read-only tool that accepts an exact URL and/or exact title and returns matching Hacker News item IDs with title, URL, author, and item URL. This should support duplicate checks before calling `hn_submit`.

### `hn_check_lo

[Read the thread](https://github.com/robertn702/webmcp-today/issues/166) · 2026-08-11 · open · 0 comments

### Support Microsoft Edge

## Summary

Add support for using WebMCP Today with Microsoft Edge. Edge is Chromium-based, but extension distribution, browser-specific configuration, and native-messaging registration may require explicit compatibility work.

## Scope

- Verify the extension works in Microsoft Edge, including package lookup and tool injection.
- Identify and address any Edge-specific Manifest V3 or permission differences.
- Support the WebMCP Today native-messaging bridge in Edge where required.
- Document ins

[Read the thread](https://github.com/robertn702/webmcp-today/issues/147) · 2026-08-08 · open · 0 comments

### Support Bun as a WebMCP Today bridge runtime

## Problem

The bridge currently rejects Bun during `setup_webmcp_bridge`, so documentation must recommend `npx` rather than `bunx`.

## Goal

Decide whether Bun can be a supported runtime for the browser-launched native host, and implement it if safe.

## Scope

- Verify Chrome and Brave can launch the wrapper with Bun's absolute executable path.
- Confirm the stdio native host and Unix socket bridge behave correctly under Bun.
- Add automated coverage for the supported runtime.
- Update the ru

[Read the thread](https://github.com/robertn702/webmcp-today/issues/127) · 2026-08-06 · closed · 0 comments

### engine: stale DOM-executor comments remain after DOM mode was cut

Found during a docs-vs-code audit (#121, #122).

**Bug:** code comments still describe a DOM execution mode / DOM executor that was cut pre-launch (`docs/DECISIONS.md` 2026-07-28 — `api` is the only execution mode). The stale comments mislead readers into thinking a DOM executor exists.

**Locations:**
- `packages/engine/src/mcp-result.ts:3` — "Shared output wrapper for both the DOM and API executors."
- `packages/engine/src/api-executor.ts:461` — confirm "mirrors the DOM executor."
- `packages/

[Read the thread](https://github.com/robertn702/webmcp-today/issues/125) · 2026-08-06 · open · 0 comments

## Most recent

### schema: `destructiveHint` annotation checked by engine but not declared in the package format

Found during a docs-vs-code audit (#121, #122).

**Bug:** the engine gates destructive tools on a `window.confirm` by reading a `destructiveHint` annotation, but the package-format annotation schema does not declare that field — so it is never validated at publish or install time, and a rejected/misshapen value silently skips the confirmation.

**Code reality:**
- `packages/engine/src/api-executor.ts:465` — `Reflect.get(annotations, "destructiveHint") === true` gates the confirm.
- `packages/sch

[Read the thread](https://github.com/robertn702/webmcp-today/issues/123) · 2026-08-06 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/robertn702/webmcp-today/issues).