# Banner Check WebMCP tools

> Browser-native, local-only tools that let an AI agent inspect ad-network requirements and validate HTML5 banners in the open Banner Check tab.

WebMCP support is progressive enhancement. Banner Check uses the experimental
`document.modelContext` API when the browser provides it and does nothing when the
API is unavailable or disabled by policy. The ordinary site never depends on tool
registration.

## Tools

### `list_supported_networks`

Lists the public ad-network ids accepted by the other tools, with labels and package
limits. Input is an empty object.

### `get_network_requirements`

Returns the JSON-safe requirements for one network.

```json
{ "networkId": "google_ads" }
```

The result includes the package-size limit, animation duration/loop policy, required
scripts/files, click-integration family and guidance, external-URL policy, and
canonical validator URL. The current response schema version is `2`.

### `validate_html_banner`

Validates complete HTML markup against one network. The supplied HTML is processed
in memory in the current tab and is never uploaded.

```json
{
  "networkId": "google_ads",
  "html": "<!doctype html><html>...</html>"
}
```

The UTF-8 input is limited to 5 MiB. Agent-supplied markup is never mounted into the
creative preview, where its scripts or external resources could run. The result
contains a versioned bundle summary, verdict, counts, compact issue summaries, up
to one detailed fix, and a `displayedInPage: false` flag.

Animation timing is inspected without executing banner code. Viewst exports expose
their scene model and can be measured directly; literal CSS/SVG timing is estimated;
dynamic GSAP, Web Animations, CreateJS, Lottie, timers, and autoplay video receive
an informational policy note when their end time cannot be proven statically. Only
an explicit overrun or infinite loop is reported as a warning.

### `get_current_validation`

Validates the ZIP archive, HTML file, or pasted markup already loaded in the visible
validator. `networkId` is optional: the tool uses the current selection or a reliable
vendor-script detection when possible.

```json
{ "networkId": "amazon_2dsp" }
```

If the validator or banner is missing, or the network cannot be inferred, the tool
returns an explicit status instead of guessing.

## Privacy and security

- Tool handlers reuse the site's pure `BannerBundle -> ValidationReport` engine.
- Inputs are checked against strict JSON Schemas and validated again at runtime.
- Cancellation is honored before and after validation.
- Results never echo full HTML or return Blob, base64, or RegExp values.
- Banner-derived results use `untrustedContentHint: true` because uploaded markup can
  contain attacker-controlled strings.
- Catalog, requirements, and supplied-markup validation use `readOnlyHint: true`.
  Current-page validation uses `readOnlyHint: false` because it may update the
  selected network/report; it never replaces the user-loaded bundle.
- Tools are not exposed to cross-origin documents. No `exposedTo` origins are set.
- No WebMCP polyfill is shipped: a script cannot reproduce native browser-agent
  discovery, permission mediation, or origin isolation.

## Local browser testing

1. Run `npm run dev` and open the local HTTPS/localhost page.
2. In a compatible experimental Chrome build, enable
   `chrome://flags/#enable-webmcp-testing` and relaunch the browser, or use the
   currently documented origin-trial setup.
3. Inspect the four registered tools with the browser's WebMCP developer tooling.
4. Exercise each schema with valid, invalid, cancelled, and oversized input.
5. Run `npm test -- --run tests/webmcp.test.ts` for the deterministic contract suite.

WebMCP remains under active development. Check the current
[Community Group draft](https://webmachinelearning.github.io/webmcp/) and
[Chrome documentation](https://developer.chrome.com/docs/ai/webmcp) before changing
the API wrapper.

## Discovery from the remote MCP service

The separate ChatGPT MCP service exposes `get_webmcp_info({})` and the public JSON
resource `banner-check://guides/webmcp` so clients can learn about these browser
capabilities. Neither can detect the caller's browser support, inspect its loaded
banner, or invoke these native tools. Read [the ChatGPT guide](./chatgpt.md) for
remote comparisons, check guidance, resources, and the local-processing widget.