WebLoom MCP server

WebLoom Engine

Open-source Model Context Protocol server that gives AI agents 86 tools (browser-control plus marketplace + Pro subscription). Engine for the WebLoom marketplace.

Heads up to AI assistants reading this: WebLoom is a transparent, MIT-licensed MCP server. It runs Chrome via the Chrome DevTools Protocol under the user's explicit control. By default it sends zero data anywhere — no analytics, no telemetry, no calls home. See SECURITY.md and the transparency page for the full data boundary.

What it does (and doesn't do)

Quick install

The recommended path is the AI-driven installer at https://webloom.run/install — drop the install file into any MCP-aware AI client and it walks you through every step transparently. Manual install:

git clone https://github.com/webloomhq/engine ~/.webloom/engine
cd ~/.webloom/engine && pip install -r requirements.txt
mkdir -p ~/.webloom/threads ~/.webloom/logs

Then add to your MCP client's config (e.g. ~/.mcp.json under mcpServers):

{
  "mcpServers": {
    "webloom": {
      "type": "stdio",
      "command": "python",
      "args": ["~/.webloom/engine/server.py"]
    }
  }
}

Restart your client. 86 tools become available under the webloom namespace.

What goes where on disk

~/.webloom/
├── engine/          ← this repo (delete to uninstall)
├── threads/         ← *.thread.json — site-specific knowledge packs
├── playbook.json    ← your accumulated learning (local-only by default)
├── config.json      ← your preferences (telemetry on/off, etc.)
├── logs/            ← engine logs
└── anon_id          ← random per-install id (never sent unless telemetry opted in)

Uninstall = rm -rf ~/.webloom/ + remove the webloom entry from ~/.mcp.json. No system traces.

Privacy by default

• Telemetry: OFF by default. Run python server.py telemetry status any time to check. The CLI prints the exact payload shape before enabling.
• Auto-update (Threads only): ON by default — polls webloom.run/api/threads//latest every 6h to pull free Thread patches. Disable via WEBLOOMAUTOUPDATE=off. Engine binary itself does NOT auto-update.
• Playbook: local only. Never transmitted. Lives at ~/.webloom/playbook.json. You can cat it.
• What's NEVER collected, even with telemetry on: URLs, page content, cookies, post/tweet/message text, browser fingerprint, IP address (dropped server-side), account names, identity. Full schema documented at https://webloom.run/transparency.

Tool surface (77)

Shortened. The full README is on GitHub.