use-webmcp-tool
React hook for registering WebMCP tools (document.modelContext) with lifecycle-managed registration and MCP result normalization.
No outside reports on file
Use this package only when you fully control what tools are exposed, validate all inputs strictly, and trust your dependency chain.
Based on public adoption and transparency signals as of Oct 28, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachFetches arbitrary web URLsREVIEW
- CredentialsNo API token requiredLOW
- Package sourcenpm (use-webmcp-tool)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
npx -y use-webmcp-toolEverything known
We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.
0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: D (from public signals such as stars and downloads, not a code review). Graded 2026-10-28.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About Use Webmcp Tool
This is a React hook that helps developers connect WebMCP tools (a browser feature for AI assistants to use specialized functions) into their React apps. It handles the setup, cleanup, and formatting of results from these tools automatically.
Who it’s for
React developers building web applications that need to expose custom tools or capabilities to AI assistants through the WebMCP standard. It's mainly useful for teams integrating Claude or other AI models into web-based projects.
Alternatives
- MCP SDK for TypeScript — Official Model Context Protocol implementation for Node.js and TypeScript
- Anthropic SDK — Direct integration with Claude through Anthropic's official libraries
- LangChain — Broader AI framework with tool-calling support across multiple models
- Vercel AI SDK — React-focused SDK for building AI applications with streaming support
Setup
Check these steps against the project’s own instructions before running anything.
Install via npm:
npm install use-webmcp-tool
Then import and use the hook in your React components. Follow the project's README for specific integration steps with your AI model.
Why this grade
Signal-based grade (1/7 points): no public source code found. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- Weekly npm downloads
- 45.6k
- Listing last refreshed
- 2026-10-30
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Data exposure: Any tool registered through this hook can be called by the AI assistant, potentially exposing sensitive user data, API keys, or internal logic if not carefully scoped
- Tool injection: Malicious web pages or compromised dependencies could register fake tools that trick the AI into calling them instead of legitimate ones
- Unvalidated inputs: The AI could pass unexpected or malicious data to your registered tools if you don't validate all inputs
- Session hijacking: If used in a shared browser environment, one user's session could access another user's registered tools
- Supply chain risk: Updates to this package or its dependencies could introduce vulnerabilities that expose your tool implementations
How to lower the risk
Least-privilege permissions
- Only expose tools that are absolutely necessary for your use case
- Limit each tool to minimal data access and specific operations
Network isolation
- Run tools in sandboxed contexts when possible
- Restrict which domains or origins can register tools
Monitoring
- Log all tool calls with timestamps and parameters
- Alert on unusual tool registration or invocation patterns
Red flags to watch for
- Unexpected new tools appearing in your tool registry
- Errors or timeouts when calling tools
- Changes to tool behavior after updates
Questions
How do I install Use Webmcp Tool?
Run npx -y use-webmcp-tool in your terminal, or add the server entry to your claude_desktop_config.json or .cursor/mcp.json as shown in the Setup section on this page.
Are there security reports about Use Webmcp Tool?
No reports found for this package in our research (last checked 2026-10-30). Use Webmcp Tool currently holds Grade D (High risk signals) based on public adoption and transparency signals. Key risk areas to watch include data exposure, tool injection, unvalidated inputs.
Is Use Webmcp Tool actively maintained?
Use Webmcp Tool has 45.6k weekly npm downloads, with its latest repository commit pushed on 2026-10-21. Our directory data was last refreshed on 2026-10-30. Check recent commit activity, release tags, and open issues before pinning it in production.
What are alternatives to Use Webmcp Tool?
Notable alternatives to Use Webmcp Tool include MCP SDK for TypeScript (Official Model Context Protocol implementation for Node.js and TypeScript), Anthropic SDK (Direct integration with Claude through Anthropic's official libraries), LangChain (Broader AI framework with tool-calling support across multiple models), Vercel AI SDK (React-focused SDK for building AI applications with streaming support). You can also compare Use Webmcp Tool side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use Use Webmcp Tool? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/googlechromelabs-use-webmcp-tool)HTML embed:
<a href="https://agentarmorhq.com/skills/googlechromelabs-use-webmcp-tool"><img src="https://agentarmorhq.com/api/badge/googlechromelabs-use-webmcp-tool" alt="AgentArmorHQ Risk Grade for Use Webmcp Tool" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "googlechromelabs-use-webmcp-tool"Share with your security lead
Need sign-off to use use-webmcp-tool? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: use-webmcp-tool
- **Listing URL:** https://agentarmorhq.com/skills/googlechromelabs-use-webmcp-tool
- **Type:** App connector
- **Risk Grade:** Grade D (High risk signals)
- **Outside Security Advisories on File:** 0
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Fetches arbitrary web URLs
- **Credentials:** No API token required
- **Package source:** npm (use-webmcp-tool)
#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts use-webmcp-tool`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 28, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Install command
- npm install use-webmcp-tool
- Est. context load
- ~850 tokens / turn (~5 tool schemas, 0.43% of 200k context)
- Popularity
- 45.6k weekly npm downloads
- Last updated
- 2026-10-30
- Last graded
- 2026-10-28
Community
Discussions for Use Webmcp Tool
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude