Reported issues for WebMCP Today

Pod holds 9 of 9 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to WebMCP Today.

Most discussed

fix(schema): prevent URL patterns from exceeding visible package scope

Problem

Published packages can currently declare global or public-suffix-style URL patterns that do not reflect the package domain shown to users. Examples include *://*/* and patterns such as *://*.com/*.

Relevant behavior:

• packages/schema/src/url-matching.ts accepts * as the entire host and treats it as covering every hostname.
• The same host-coverage logic accepts wildcard suffixes without checking whether the suffix is a public suffix or bare TLD.
• `packages/schema/src/pack

Read the thread · 2026-08-03 · closed · 2 comments

fix(extension): scope popup package suggestions to the active page

Problem

The extension popup currently fetches the globally newest registry packages from GET /api/packages?pageSize=6 whenever no installed package matches the active tab. This can show packages unrelated to the page the user is viewing, and publishing a new version moves a package into the global suggestion surface.

Relevant code:

• apps/extension/src/lib/suggestions.ts fetches packages without a domain filter.
• apps/extension/src/entrypoints/background.ts has the active tab URL/ho

Read the thread · 2026-08-03 · closed · 1 comment

Document bunx as an alternative to npx for the MCP bridge

The quickstart currently shows the MCP bridge configured with npx, but the prerequisites also allow Bun.

For Bun users, please document the equivalent MCP configuration using bunx, for example:

MCP configuration: [mcp_servers.webmcp-today] command = /Users/USERNAME/.bun/bin/bunx args = [--yes, @webmcp-today/mcp-bridge@0.3.0]

It would also help to mention that Codex may not inherit the interactive shell PATH, so an absolute bunx path may be needed. This would make the Bun path clearer for the

Read the thread · 2026-08-14 · open · 0 comments

Omit optional query parameters when placeholder input is absent

Problem

Optional tool inputs used as query placeholders currently interpolate to an empty string when omitted. For example:

{
  "query": {
    "period": "{{period}}",
    "pagination_cursor": "{{pagination_cursor}}",
    "pagination_limit": "25"
  }
}

When pagination_cursor is optional and the caller omits it, the executor sends:

?period=future&pagination_cursor=&pagination_limit=25

rather than omitting pagination_cursor.

This makes common cursor-pagination A

Read the thread · 2026-08-12 · closed · 0 comments

Add Hacker News read tools for safe posting workflows

Problem

The Hacker News package currently exposes hn_submit, hn_get_item, hn_list_children, hn_comment, and hn_vote, but it cannot safely perform the required pre-write checks for an automated posting workflow.

Requested tools

hn_find_submissions

Add a read-only tool that accepts an exact URL and/or exact title and returns matching Hacker News item IDs with title, URL, author, and item URL. This should support duplicate checks before calling hn_submit.

`hn_check_lo

Read the thread · 2026-08-11 · open · 0 comments

Support Microsoft Edge

Summary

Add support for using WebMCP Today with Microsoft Edge. Edge is Chromium-based, but extension distribution, browser-specific configuration, and native-messaging registration may require explicit compatibility work.

Scope

• Verify the extension works in Microsoft Edge, including package lookup and tool injection.
• Identify and address any Edge-specific Manifest V3 or permission differences.
• Support the WebMCP Today native-messaging bridge in Edge where required.
• Document ins

Read the thread · 2026-08-08 · open · 0 comments

Support Bun as a WebMCP Today bridge runtime

Problem

The bridge currently rejects Bun during setup_webmcp_bridge, so documentation must recommend npx rather than bunx.

Goal

Decide whether Bun can be a supported runtime for the browser-launched native host, and implement it if safe.

Scope

• Verify Chrome and Brave can launch the wrapper with Bun's absolute executable path.
• Confirm the stdio native host and Unix socket bridge behave correctly under Bun.
• Add automated coverage for the supported runtime.
• Update the ru

Read the thread · 2026-08-06 · closed · 0 comments

engine: stale DOM-executor comments remain after DOM mode was cut

Found during a docs-vs-code audit (#121, #122).

Bug: code comments still describe a DOM execution mode / DOM executor that was cut pre-launch (docs/DECISIONS.md 2026-07-28 — api is the only execution mode). The stale comments mislead readers into thinking a DOM executor exists.

Locations:

• packages/engine/src/mcp-result.ts:3 — "Shared output wrapper for both the DOM and API executors."
• packages/engine/src/api-executor.ts:461 — confirm "mirrors the DOM executor."
• `packages/

Read the thread · 2026-08-06 · open · 0 comments

Most recent

schema: destructiveHint annotation checked by engine but not declared in the package format

Found during a docs-vs-code audit (#121, #122).

Bug: the engine gates destructive tools on a window.confirm by reading a destructiveHint annotation, but the package-format annotation schema does not declare that field — so it is never validated at publish or install time, and a rejected/misshapen value silently skips the confirmation.

Code reality:

• packages/engine/src/api-executor.ts:465 — Reflect.get(annotations, "destructiveHint") === true gates the confirm.
• `packages/sch

Read the thread · 2026-08-06 · closed · 0 comments

The remaining reports are on the project's issue tracker.