A human-in-the-loop security triage workspace where analysts and AI agents investigate findings, preserve judgment, and build explainable remediation sprints through browser-native WebMCP tools.
Outpost is a complete OpenAI WebMCP Challenge project. It ships a polished manual application and exposes the same domain operations to compatible agents with document.modelContext.registerTool(...). The UI and every WebMCP tool mutate one shared, durable browser workspace—no shadow database, fake tool buttons, or DOM-click simulation.
Security triage is structured but contextual. Agents are good at scanning many findings, comparing evidence, and fitting work into a limited sprint. Humans must retain control of severity, acceptance, and scheduling decisions. Without WebMCP, an agent has to infer the page, locate controls, click through menus, and guess whether a change worked. Outpost instead exposes explicit, schema-validated capabilities with visible effects and provenance.
Humans can:
- review evidence, reasoning, and remediation guidance;
- adjust severity and workflow status;
- attach context, lock decisions, remove sprint items, undo, and reset the demo;
- see which actions came from a human, an agent, or the system.
Agents can:
- list and inspect findings;
- compare and reprioritize a selected set;
- calculate a transparent risk summary;
- create capacity-aware remediation sprints from an explicit selection or a one-call risk, effort, or risk-to-effort optimization;
- add notes and propose status or severity changes;
- retrieve activity history.
Human locks are enforced in the domain layer. An agent cannot change a locked rating or move a locked finding. Accepted risk and resolved work are excluded from automatic scheduling, while manual sprint removals remain excluded during later optimization and rebalancing.
Outpost feature-detects the current imperative API on document.modelContext, with the deprecated navigator.modelContext location only as a compatibility fallback. Fourteen tools are registered with JSON Schema inputs, focused descriptions, and current readOnlyHint / untrustedContentHint annotations. An AbortController unregisters the page's tool set during React cleanup.
The tool handlers call the same immutable functions used by the React interface:
Human controls ─┐
├─> validated WorkspaceApi ─> browser-persisted state ─> visible UI
WebMCP tools ───┘ └─> provenance activity log
Read WEBMCP.md for the complete tool catalog and testing prompts, and ARCHITECTURE.md for trust boundaries and state semantics.
Requirements: Node.js 22.13+ and pnpm.
pnpm install
pnpm devOpen http://localhost:3000. The full manual workflow works in ordinary browsers. For agent tools, use ChatGPT's in-app browser or a compatible Chrome build with WebMCP enabled.
pnpm typecheck
pnpm test
pnpm lint
pnpm buildThe tests cover the scoring formula, input validation, immutability, provenance, human-lock enforcement, sprint capacity, and preserved human exclusions.
All 18 seeded findings, product names, evidence items, and review events are fictional. The demo contains no live target data, credentials, exploit payloads, or offensive automation. See SECURITY.md.
- WEBMCP.md — tools, schemas, demo prompts, browser support
- ARCHITECTURE.md — state model, trust boundaries, safety properties
- JUDGES.md — two-minute evaluator path
- DEMO_SCRIPT.md — narrated video script
- DEVPOST_SUBMISSION.md — submission-ready project story
- CONTRIBUTING.md — local contribution workflow
Additional verified interface captures are in demo/screenshots: the WebMCP tool surface, finding evidence view, capacity-aware sprint, and human/agent activity history.
MIT — see LICENSE.