Kujo SSG WebMCP

Kujo SSG can turn a static site into a read-only tool source for browser agents. It needs no server, database, or application API.

Kujolang.ai live demo · RobertDeVore.com deployment · Kujo SSG source

This repository contains the videos, screenshots, code, and live evidence for the OpenAI WebMCP challenge submission.

Videos

Video	Contents
WebMCP overview	Architecture, generated runtime, tools, live sites, and security.
Live Lens walkthrough	Kujolang.ai loading, registering four tools, searching the site, and retrieving a record.

Both videos include narration, music, and sound effects. Caption files are in media/. The live walkthrough also has an optional embedded English subtitle track.

Enable WebMCP

Add one setting to the SSG config:

webmcp: true

Or use the CLI flag:

kujo run ./build.kujo -- --webmcp

The build generates a public site index and a self-hosted browser adapter. Each page loads the adapter. If the browser supports document.modelContext, the adapter registers four tools:

Tool	Purpose
get_site_info	Return site details, navigation, collections, counts, and public taxonomies.
search_site	Search public records with deterministic ranking.
list_content	List records by content type and optional taxonomy label.
get_content	Return one record by Kujo ID or same-origin URL.

The first tool call fetches the same-origin index. Later calls reuse the validated copy in memory.

How it works

Kujo knows each route, collection, taxonomy, description, and visibility rule at build time. It compiles that data into a small public index for agents while keeping the site static.

Content and routes
       ↓
Allowlisted public records
       ↓
kujo-ssg-site-index/v1
       ↓
WebMCP browser adapter
       ↓
document.modelContext tools

Live WebMCP Inspector

inspector/ contains the source used in the live video.

cd inspector
npm start
# Open http://127.0.0.1:4178

The Node server has no runtime dependencies. It downloads the current production HTML and WebMCP adapter, runs the deployed adapter with a document.modelContext host, calls the registered tools, and displays the results. It does not use fixture responses.

Lens records browser page pixels but not the native Chrome DevTools window. The inspector provides a recordable view of the same deployed adapter and tool calls. In supported Chrome builds, DevTools lists registered tools under Application > WebMCP.

Evidence

The committed evidence shows:

• Kujolang.ai and RobertDeVore.com each registered all four tools.
• Every tool used readOnlyHint: true and untrustedContentHint: true.
• Three tool calls caused one index fetch per site.
• Kujolang.ai returned three ranked results for release and retrieved the exact ShipCheck record.
• The 27-step Lens walkthrough passed without failed, blocked, or errored steps.

See live-webmcp-proof.json and the Lens report.

Security

The integration exposes public content only:

• Drafts stay out of the index.
• The index contains allowlisted plain-text fields, not raw Markdown or HTML.
• JSON Schema rejects unknown tool arguments.
• Outputs are bounded and ordered.
• The adapter fetches the index from the same origin.
• Tools cannot change the DOM, write storage, access credentials, publish content, deploy code, or call authenticated operations.

Website text remains untrusted data. See docs/security.md.

Repository contents

docs/          Architecture, security notes, and submission guide
evidence/      Live proof, Lens reports, and media metadata
examples/      SSG config, generated markup, and tool contracts
inspector/     Live inspector source
media/         Narrated videos and captions
screenshots/   Overview frames and inspector captures

WebMCP is progressive enhancement. Browsers without it still receive the standard static site.

License

MIT. See LICENSE.