MCP Observatory
3m ago Tracked 60,021 Last 3m ago 24h 2,474
github TypeScript analyzed 8599cf4

opentiny/webmcp-sdk

github

OpenTiny NEXT-SDKs is a front-end AI and browser automation toolkit. It implements WebMCP + WebSkills to build AI-native apps, and leverages webmcp-cli to enable LLM agents to remote-control any webpage without source code modifications. OpenTiny NEXT-SDKs 是一套前端 AI 与浏览器自动化工具包。它通过 WebMCP + WebSkills 协议构建 AI 原生应用，并利用 webmcp-cli 实现了无需修改源码即可让大模型代理自动控制任

maintainer
opentiny
licence
MIT
first seen
2026-06-06
last seen
2026-09-15
releases · 30d
4
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret ×2 in opentiny/webmcp-sdk
  2. HIGH code analysis flagged committed secret ×2 in opentiny/webmcp-sdk
  3. HIGH code analysis flagged committed secret ×2 in opentiny/webmcp-sdk
  4. HIGH code analysis flagged committed secret ×2 in opentiny/webmcp-sdk
  5. HIGH code analysis flagged committed secret ×2 in opentiny/webmcp-sdk
  6. HIGH code analysis flagged committed secret ×2 in opentiny/webmcp-sdk
  7. HIGH code analysis flagged committed secret ×2 in opentiny/webmcp-sdk
  8. HIGH code analysis flagged committed secret ×2 in opentiny/webmcp-sdk
  9. HIGH code analysis flagged committed secret ×2 in opentiny/webmcp-sdk
  10. HIGH code analysis flagged committed secret ×2, dynamic code execution ×3 in opentiny/webmcp-sdk
  11. HIGH code analysis flagged committed secret ×2, dynamic code execution in opentiny/webmcp-sdk
  12. HIGH code analysis flagged committed secret ×2, dynamic code execution in opentiny/webmcp-sdk
  13. HIGH code analysis flagged committed secret ×2, dynamic code execution in opentiny/webmcp-sdk
  14. HIGH code analysis flagged committed secret ×2, dynamic code execution in opentiny/webmcp-sdk
  15. HIGH code analysis flagged committed secret ×2, dynamic code execution in opentiny/webmcp-sdk
  16. HIGH code analysis flagged committed secret ×2, dynamic code execution in opentiny/webmcp-sdk
  17. HIGH code analysis flagged committed secret ×2, dynamic code execution in opentiny/webmcp-sdk
capabilities 1 tools
transport — counts 1 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • button-control
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 8599cf4 · analyzer v33 · 3d ago

skills & prompt files 21

danger signals6

code evidence vv0.4.10 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 289

filesystem 17

  • fs (weak) opentiny-webmcp-sdk-8599cf4/.github/scripts/lib/pr-gate-artifacts.mjs :5 import fs from 'node:fs'
  • fs (weak) opentiny-webmcp-sdk-8599cf4/.github/scripts/pr-gate.mjs :12 import fs from 'node:fs'
  • fs (weak) opentiny-webmcp-sdk-8599cf4/packages/next-remoter/vite.config.ts :3 import { readFileSync } from 'node:fs'
  • fs opentiny-webmcp-sdk-8599cf4/packages/next-sdk/script/utils.ts :1 import { readFileSync } from 'fs'
  • fs (weak) opentiny-webmcp-sdk-8599cf4/packages/next-sdk/test/dev-entry.test.ts :1 import { readFileSync } from 'node:fs'
  • fs (weak) opentiny-webmcp-sdk-8599cf4/packages/next-sdk/test/page-tools/pr-gate-auto-artifact.test.ts :2 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
  • fs opentiny-webmcp-sdk-8599cf4/packages/next-wxt/plugins/vite-plugin-manifest-options.ts :3 import * as fs from 'fs'
  • fs opentiny-webmcp-sdk-8599cf4/packages/next-wxt/plugins/vite-plugin-mcp-servers.ts :3 import * as fs from 'fs'
  • fs (weak) opentiny-webmcp-sdk-8599cf4/packages/next-wxt/scripts/fix-manifest-options.mjs :8 import * as fs from 'fs'
  • fs (weak) opentiny-webmcp-sdk-8599cf4/packages/webmcp-cli/scripts/build-inject.mjs :2 import { mkdirSync, readdirSync, statSync } from 'fs'
  • fs opentiny-webmcp-sdk-8599cf4/packages/webmcp-cli/src/bin.ts :2 import fs from 'fs'
  • fs opentiny-webmcp-sdk-8599cf4/packages/webmcp-cli/src/browser.ts :3 import fs from 'fs'
show 5 more
  • fs opentiny-webmcp-sdk-8599cf4/packages/webmcp-cli/src/expand-file-refs.ts :1 import { readFileSync } from 'fs'
  • fs (weak) opentiny-webmcp-sdk-8599cf4/packages/webmcp-cli/test/browser.e2e.test.ts :6 import { existsSync, mkdtempSync, rmSync } from 'fs'
  • fs (weak) opentiny-webmcp-sdk-8599cf4/packages/webmcp-cli/test/expand-file-refs.test.ts :1 import { mkdirSync, readFileSync, writeFileSync } from 'fs'
  • fs (weak) opentiny-webmcp-sdk-8599cf4/packages/webmcp-cli/test/parse-run-args.test.ts :2 import { mkdirSync, writeFileSync } from 'fs'
  • fs (weak) opentiny-webmcp-sdk-8599cf4/scripts/skills-sync.mjs :8 import fs from 'node:fs'

shell / exec 8

  • shell (weak) opentiny-webmcp-sdk-8599cf4/packages/next-sdk/test/page-tools/pr-gate-auto-artifact.test.ts :5 import { spawnSync } from 'node:child_process'
  • shell opentiny-webmcp-sdk-8599cf4/packages/next-wxt/entrypoints/background/inject-user-mcp-scripts.ts :8 * 能力令牌：先 bind(token) 再 exec(code, token)；token 仅存于 background（及桥闭包）。
  • shell opentiny-webmcp-sdk-8599cf4/packages/next-wxt/entrypoints/content.ts :92 * → background bind(token) → exec(code, token)
  • shell opentiny-webmcp-sdk-8599cf4/packages/next-wxt/public/vendor/user-mcp-exec.js :8 * 3. bind 用闭包保存 token，安装不可配置的 exec(code, capability)；校验失败则拒绝
  • shell (weak) opentiny-webmcp-sdk-8599cf4/packages/next-wxt/test/user-mcp-scripts/csp-bridge-repro.test.ts :61 it('injectUserMcpScriptsForTab：先 bind(token) 再经 MAIN world 调用 exec(code, token)', async () => {
  • shell opentiny-webmcp-sdk-8599cf4/packages/next-wxt/user-mcp-scripts/exec-bridge.ts :14 * 4. background：bind(token) → exec(code, token)
  • shell opentiny-webmcp-sdk-8599cf4/packages/webmcp-cli/src/browser.ts :7 import { spawn } from 'child_process'
  • shell (weak) opentiny-webmcp-sdk-8599cf4/packages/webmcp-cli/test/browser.e2e.test.ts :5 import { spawnSync } from 'child_process'

network 4

  • net opentiny-webmcp-sdk-8599cf4/packages/next-remoter/src/composable/usePluginSession.ts :74 const response = await fetch(`${agentRoot.value}client?sessionId=${input.slice(1)}`)
  • net opentiny-webmcp-sdk-8599cf4/packages/next-sdk-playground/src/utils/versions.ts :21 const response = await fetch(`https://registry.npmmirror.com/${pkg}`)
  • net opentiny-webmcp-sdk-8599cf4/packages/webmcp-cli/src/browser.ts :6 import http from 'http'
  • net (weak) opentiny-webmcp-sdk-8599cf4/packages/webmcp-cli/test/browser.e2e.test.ts :7 import http from 'http'

secrets 1

  • secrets (weak) opentiny-webmcp-sdk-8599cf4/packages/doc-ai/vite.config.ts :21 TINY_USER_TOKEN: process.env.TINY_USER_TOKEN

tool registrations 1

  • button-control opentiny-webmcp-sdk-8599cf4/packages/next-sdk-playground/src/utils/default-files.ts :37

install hooks 3

  • prepare opentiny-webmcp-sdk-8599cf4/package.json :8 node ./scripts/skills-sync.mjs
  • postinstall opentiny-webmcp-sdk-8599cf4/packages/next-wxt/package.json :19 wxt prepare
  • prepublishOnly opentiny-webmcp-sdk-8599cf4/packages/webmcp-cli/package.json :19 pnpm run build

declared dependencies 2

  • @modelcontextprotocol/inspector@catalog:
  • prettier@catalog:

clipboard 2

  • navigator.clipboard opentiny-webmcp-sdk-8599cf4/packages/next-sdk/page-tools/handlers/clipboard.ts :7 await navigator.clipboard.writeText(args.text)
  • clipboard dependency opentiny-webmcp-sdk-8599cf4/packages/webmcp-cli/src/commands/clipboard.ts :1 import clipboard from 'clipboardy'