Introduction

The problem

WebMCP lets your web app expose tools that AI agents can call, but somebody has to write those tools. Today that means hand-writing a registerTool() call per action: a name, a description, a JSON Schema for the inputs, an execute function. For one endpoint that's a chore. For an API with seventy endpoints it's a project nobody starts.

And the details matter more than they look: a tool's description is literally part of the prompt the agent reasons over, and its schema is the contract the agent fills in. Hand-written copies of things your spec already knows go stale, drift, and lie.

What webmcp-codegen does

You already have an OpenAPI spec. webmcp-codegen turns it into WebMCP tools, written as real TypeScript files in your repo:

npx @webmcp-stack/codegen generate

Detected apps/server/openapi/openapi.json (override with --spec)
Found your web app: apps/web (next)

webmcp-codegen: 7 tool(s)

  note: Stripped the shared "v1" version prefix from tool names.

  1 endpoint(s) skipped:
    POST /v1/payments/webhook: a webhook receives server callbacks

  list-trips              [read]         ← GET /v1/trips/
  create-trip             [write]        starts disabled
  delete-trip             [destructive]  starts disabled
  ...

  registration:
    created apps/web/src/webmcp/register.tsx
    added 2 lines to apps/web/src/app/layout.tsx

Three things happen in that one run. Tools are generated (read tools with working implementations, mutations generated but disabled until you uncomment them). Endpoints that should not be agent tools are filtered or flagged (webhooks, auth, admin). And registration is wired into your app, two additive lines you can see and undo.

Three promises

Tools work out of the box. The spec knows the method, path, and parameters, so read tools are born calling your real API with the signed-in user's session. Mutations get the same working code, commented out, one deliberate edit away.

You own the output. Generated files are plain TypeScript in your repo. No runtime dependency on webmcp-codegen. Uninstall it after generating and everything still works.

Regeneration never clobbers your code. The API contract lives above a marker line and regenerates freely. Your code lives below it and is never touched. Hand-edit the generated region and you get a .new file to merge, never a silent overwrite.

See it before you run it

Every claim on this page is verifiable without installing anything:

npx @webmcp-stack/codegen generate --dry-run

A dry run writes nothing. It shows you the tools, the safety report, and the plan.

Status

WebMCP is an early-stage spec. The tools work today in Chrome behind a flag, and elsewhere with a small polyfill. OpenAPI is the supported source; tRPC, Zod, and Prisma are on the roadmap.