Skip to main content

Webscope

A lightweight, token-efficient MCP server (stdio, JSON-RPC 2.0, Python standard library only). It provides coding agents with short, surgical answers: grouped search hits, isolated symbols instead of whole files, native in-browser testing on the user's open Chrome, and bounded project scripts.

Tool names, parameters, and messages are in Spanish.


Quick Start

1. Initialize your project

Run in your project root to auto-detect your stack (Laravel, Vue/React, Astro, Python, or generic) and generate webscope.json:

# Via uvx (no install needed)
uvx webscope-mcp --init

# Or locally with Python
python3 webscope.py --init

2. Register with your MCP client

# Claude Code (recommended, writes project .mcp.json)
claude mcp add --scope project webscope -- uvx --from git+https://github.com/partprogramming09/webscope@v0.3.0 webscope-mcp --manifest "$PWD/webscope.json"

# With pip
pip install git+https://github.com/partprogramming09/webscope.git@v0.3.0
claude mcp add --scope project webscope -- webscope-mcp --manifest "$PWD/webscope.json"

Start claude and verify with /mcp: webscope will be connected with search, read, and run.


Tools

Tool Description
search(text, where?, limit?, format?, context?, regex?) Case-insensitive search grouped by file with relevance ranking. format="concise" returns top 5 files. Skips secrets (.env, *.key).
read(file, symbol?, lines?, max_lines?, tail?, contains?, format?) Surgical read: extracts a single function, method, class (PHP, TS, JS, Vue, Python), Markdown section, line range, or log tail (tail).
run(name?, args?, detail?) Runs a declared read-only script from the manifest. Output trimmed to head and tail limits.
run_write(name, args) Runs scripts declared in writes. Requires WEBSCOPE_WRITE=1 and interactive user confirmation.

Every response starts with a one-line actionable guide and is capped at token_limit (~4 characters per token).


In-Browser Testing & Chrome Connector (e2e_chrome.py)

Webscope includes an in-browser automation engine that replaces heavy screenshot-based tools with lightweight DOM extraction:

Native Chrome Connector (--evaluate)

Operates directly on the developer's open Google Chrome window without opening clean/incognito profiles, preserving your active cookies, logins, and 2FA:

# Inspect current screen on active tab
python3 webscope_adapters/e2e_chrome.py --evaluate "window.__f.state()"

# Run on a tab matching a specific URL
python3 webscope_adapters/e2e_chrome.py --evaluate "window.__f.state()" "localhost:5173"

# Run a complete JS test flow
python3 webscope_adapters/e2e_chrome.py --evaluate test_flow.js "localhost:5173"

Key Capabilities

  • Screen & Form Helpers (__f): Finds inputs by visible label, fills values, coordinates clicks with active settle wait (calma()), and verifies persistence.
  • Network Capture (__e2e): Intercepts /api/ calls, latency (ms), and console errors without screenshots.
  • Self-Healing Across Reloads: Injected helpers tolerate full page reloads (window.location.reload()) with automatic re-initialization.
  • Zero-Token Replay (--replay <name>): Replays recorded user flows in one call with 0 AI tokens.
  • Playwright Export (--export <capture> <url>): Converts recorded steps into clean .spec.js Playwright tests.

The Essential Testing Contract: Full Lifecycle (CRUD + Sub-modules)

A module is never considered tested by merely reading a view or clicking a button. Webscope enforces a strict full-lifecycle standard:

  1. Create (C): Fill mandatory and conditional fields, submit, verify HTTP 200/201, and capture the generated record ID.
  2. Edit (U): Reopen the record, mutate fields, and verify data persistence in both UI and database.
  3. Exercise Sub-modules & Lifecycle: Navigate sub-routes (:id), exercise child panels/tabs (e.g. characteristics, tariffs, pre-settlements, notes, print), and trigger state transitions (e.g. approve, reopen, duplicate).
  4. Delete & Clean (D): Delete the test record, confirm UI removal, and verify database clean state (ZZ_E2E).

Configuration (webscope.json)

All behavior is project-contained. See webscope.example.json.

{
  "root": ".",
  "trim": { "head": 10, "tail": 70 },
  "token_limit": 5000,
  "storage": ".agents/webscope",
  "test_prefix": "ZZ_E2E",
  "search": { "dirs": ["src"], "extensions": ["ts", "vue", "php", "py"] },
  "allowed_env": ["DATABASE_URL"],
  "scripts": {
    "report": {
      "cmd": ["python3", "-I", "scripts/report.py"],
      "description": "Summarises a database table",
      "usage": "<table>",
      "rejects": ["--out"],
      "writes": ["--fix"],
      "timeout": 120
    }
  }
}
Key Description
root Project root relative to manifest directory.
extra_roots Folders outside root, relative to the manifest directory, that search and read may also read (for example a logs folder). Secret files stay blocked.
token_limit Hard limit on response size in approximate tokens.
trim Default head (head) and tail (tail) lines kept from script outputs.
storage Internal storage for module-map.json, flows/, walkthroughs/. Autodetects .agents/webscope/, .claude/webscope/, or .webscope/.
test_prefix Prefix for test entities (default ZZ_E2E).
search.dirs, extensions Folders and extensions searched by default.
allowed_env Environment variables passed to child scripts.
scripts.<name> Fixed command list (cmd), rejects (blocked flags), writes (write flags).

Included Adapters ({adapters})

Ready-made scripts shipped in the package. Use {adapters} in cmd:

Script Purpose Stack
e2e_chrome.py Browser walk, form automation (__f), replay, and open Chrome connector (--evaluate). Any SPA
vue_ts.py (map) Module mapping: routes, subroutes, clickable actions, API calls, and E2E coverage. Vue 3 + TS
laravel.py (map_back) Resolves endpoint → controller → service → model → database table. Laravel
astro.py (map_web) File-based routes, components, form fields, and client scripts. Astro
db_check.php SELECT-only database integrity checks by prefix marker from .env. MySQL / Postgres
payload_check.py Compares captures against FormRequest rules, Resources, and columns. Laravel
cleanup_test_rows.py Lists and safely cleans test rows matching the test prefix. Laravel
session_cost.py Token and USD cost auditor per model for Claude Code sessions. Claude Code

Subagents Integration

Webscope keeps subagents fast and lightweight (~9.3k tokens initial load vs 28.8k).

Exporting the walkthrough Agent

Export the ready-made walk agent without overwriting existing agents:

# Autodetects .agents/ or .claude/agents/
webscope-mcp --agent

# Or targeting a specific folder
webscope-mcp --agent [directory]
  • Non-destructive: Never overwrites existing agent files unless --force is passed.
  • Isolation: Leaves all other user-defined agents untouched.

Declaring Tools in Agents

In your .agents/<name>.md or .claude/agents/<name>.md:

---
name: navegador
tools: Read, Grep, Glob, mcp__webscope__search, mcp__webscope__read, mcp__webscope__run
model: sonnet
effort: high
---

Configuration in Other Clients

Claude Desktop (claude_desktop_config.json)

{
  "mcpServers": {
    "webscope": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/partprogramming09/webscope@v0.3.0", "webscope-mcp", "--manifest", "/absolute/path/to/webscope.json"]
    }
  }
}

Cursor / VS Code / Cline (.cursor/mcp.json or .vscode/mcp.json)

{
  "mcpServers": {
    "webscope": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/partprogramming09/webscope@v0.3.0", "webscope-mcp", "--manifest", "${workspaceFolder}/webscope.json"]
    }
  }
}

Zed (settings.json)

{
  "context_servers": {
    "webscope": {
      "command": {
        "path": "uvx",
        "args": ["--from", "git+https://github.com/partprogramming09/webscope@v0.3.0", "webscope-mcp", "--manifest", "/absolute/path/to/webscope.json"]
      }
    }
  }
}

Updating

# uvx: refresh package cache
uv cache clean webscope-mcp

# pip: force reinstall
pip install --upgrade --force-reinstall git+https://github.com/partprogramming09/webscope.git@v0.3.0

Security Model

  • Root Sandbox: search and read resolve strictly within root and reject outside paths.
  • Invisible Secrets: Automatically hides .env*, *.pem, *.key, *.p12, id_rsa*, id_ed25519*, auth.json, and credentials.
  • No Shell Injection: Scripts execute as fixed argument lists without intermediate shell.
  • Read-Only Default: Destructive arguments (writes) require run_write, WEBSCOPE_WRITE=1, and explicit approval.
# Temporary Webscope artifacts
captures/
.webscope/captures/

Commit webscope.json, .claude/webscope/walkthroughs/ (or .agents/webscope/), and module-map.json.


Tests

python3 -I test_webscope.py

License

MIT

Metadata

Release files for webscope-mcp 0.4.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for webscope-mcp 0.4.0
File Size Uploaded Provenance
webscope_mcp-0.4.0.tar.gz 95.4 kB With provenance Details

Built distribution (wheel)

Table of built distributions (wheels) for webscope-mcp 0.4.0
File Interpreter ABI Platform
webscope_mcp-0.4.0-py3-none-any.whl Python 3 none any Details

Total release size: 199.0 kB

Release files / webscope_mcp-0.4.0.tar.gz

Download URL webscope_mcp-0.4.0.tar.gz
Size 95.4 kB
Tags Source
SHA-256 checksum
How to use checksums
e64a753d7d0dca07f4b3968f210ba5fa80a6c6aaf1765bd3594aaa698b776c04
BLAKE2b-256 checksum
How to use checksums
f633820b499f7cee52cbc85ce44e3f8bcb6bdd91dfb48a1e150e43147deab302
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 20, 2026.

Transparency log

Release files / webscope_mcp-0.4.0-py3-none-any.whl

Download URL webscope_mcp-0.4.0-py3-none-any.whl
Size 103.6 kB
Tags Python 3
SHA-256 checksum
How to use checksums
3c954ea554e981c173199d6a5e28058281ca6e7b4d2e7834073fa45b316dd1da
BLAKE2b-256 checksum
How to use checksums
6bd3ba8157b9e9b64c294e2e78e6271c801b395d60014b3ccc569f55fdb9aeb5
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 20, 2026.

Transparency log

Security for webscope-mcp 0.4.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for webscope_mcp-0.4.0.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 20, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page