Kujo SSG's WebMCP target exposes a bounded projection of content already published as public routes. It is not an execution gateway.

• stable ID, type, slug, and deployment-aware URL;
• title, description, bounded summary, and language;
• searchable state and valid public dates;
• resolved public taxonomy labels;
• concise site metadata, navigation, and collection counts.

• drafts, source paths, build paths, and alias routes;
• arbitrary frontmatter and internal lookup IDs;
• environment or configuration state;
• credentials or authentication material;
• raw Markdown and generated HTML;
• application actions or server-side handlers.

All four tools use strict root schemas with additionalProperties: false. They are registered with readOnlyHint: true and untrustedContentHint: true.

The adapter performs one same-origin fetch, keeps the validated index only in memory, and does not mutate the DOM, write browser storage, or contact a cross-origin service. Returned website text remains untrusted result data and is never interpolated into tool descriptions, schemas, or instructions.

Authenticated reads and every write, delete, publishing, deployment, or external action belong behind a separate authenticated application boundary. Enabling WebMCP cannot expose or widen those capabilities.