Injected WebMCP Tools

Injected WebMCP tools are custom tools your agent saves for a specific website. Each one is a small JavaScript function that drives a web app you're already logged into — through your own authenticated session, doing what you could do by hand.

The point is to stop re-deriving the same work. Without them, every session spends time rediscovering how an app's API is shaped, where its session token lives, and how its data model fits together — and then throws all of it away. A saved tool makes that knowledge durable, reusable, and revertable.

How you use them

You don't hand-write these. You ask your agent, in the Browser Companion, after it's done something useful:

"Save that as a reusable tool for this site."

The agent writes the tool, gives it a name, and saves it against the site. Any later session that opens a tab on the same site can discover and re-run it.

The model

• Per-site. Tools are saved against the active tab's origin (https://app.example.com). They're only visible and runnable while a tab is actually on that site, and names are unique per origin.
• Namespaced. Names look like web.<site>.<action> — e.g. web.raylight.listProjects.
• Discovered, not listed. Injected tools aren't part of Scape's fixed MCP tool list. An agent has to ask a specific tab what tools exist (list_injected_tools), then run one (invoke_injected_tool).
• Read or write. Each tool is labeled read (observes) or write (mutates the app's state). The label shows up in the audit log.

Prerequisite: the robot toggle

Injected tools only work on a tab that's agent-enabled — the robot icon in the browser tab's toolbar must be on, same as the rest of the Browser Companion's agent access.

If it's off, every injected-tool call is rejected and your agent will ask you to click the toggle. There's also a master switch for the whole feature, on by default.

When to save a tool

Saving is a judgment call — your agent writes the code, so it decides. The rule of thumb:

Save when the interaction is reusable and parameterized. "Fetch project {id}" is worth saving; "fetch project 42, once, right now" isn't. If a future session would plausibly run it again — and it's built against the app's own API — it's a tool. If it mutates anything, it's a write tool.

Don't save throwaway one-shots, or thin wrappers around a plain browser action that carry no reused knowledge.

The authoring boundary

This is the one hard line, and it's what keeps the feature legitimate: an injected tool does what you could already do in that tab, just repeatably. Tools run with the page's own reach and nothing more — they can't touch Scape itself, other tabs, or other sites.

Safety: versions and the audit log

There's no approval popup, and by default writes don't prompt either. Instead, everything is visible after the fact and revertable:

• Every save is a version. Saving, editing, or deleting a tool creates a new immutable version. History is append-only — you can list it, see who changed what and why, and revert to any earlier version. Reverting adds a new version rather than erasing anything.
• Every run is logged. Each invocation is recorded — tool name, read/write, outcome, redacted argument and result summaries, which API hosts it talked to, and when. Summaries are scrubbed as they're written, so session tokens never land in the log.

You can ask your agent to walk you through either one at any time: "what have this site's tools done?" or "show me the version history and roll that back."

If you'd rather be asked before a write tool runs, there's an opt-in confirm write-tools setting per site (off by default).

Tools reference

Agents use these; you generally won't call them directly. Each one acts on the active browser tab.

Tool	Description
list_injected_tools	Discover the site's saved tools — names, descriptions, risk, and each tool's source
invoke_injected_tool	Run a saved tool by name with arguments
save_injected_tool	Save or update a tool (creates a new version)
delete_injected_tool	Remove a tool (history is kept and revertable)
list_injected_versions	Version history for the site's tools, plus the active version
revert_injected_tool_version	Roll the site's tools back to an earlier version
list_injected_invocations	The invocation audit log — what ran, when, and how it turned out