What you're agreeing to

WebMCP Today is a registry of tool packages submitted by publishers. A package is a JSON document that tells a browser extension how to register tools on a site the package's author doesn't control. Robert Niimi runs the registry. Listing or installing a package is not endorsement, affiliation, target-site approval, or authorization, and WebMCP Today is not affiliated with sites packages target.

There is no review queue. A package goes live the moment it validates against the schema.

You need an account to publish, create API keys, or create account-side install pins. Local installs through the browser extension do not need an account and stay in your browser; account-side pins are a separate service feature for your signed-in account. Anything done with your account, or with an API key created under it, is your responsibility. Treat a key like a password and delete it at Settings → Security if it leaks.

You have to be old enough to agree to a contract where you live.

Publish a package, through the form or by POSTing to the API, and you grant Robert Niimi a worldwide, non-exclusive, irrevocable, perpetual, royalty-free license to host, store, reproduce, modify, adapt, publish, distribute, and redistribute it, and to sublicense all of that to anyone using the registry. In practice that means the extension, the MCP server, the public API, and anyone reading the API directly.

You keep your copyright. This is a license, not a handover. Your own work stays yours to use anywhere else, under any terms you like.

Irrevocable matters here. Versions are append-only, so the license on copies already distributed stands. Removing public listing/access does not undo that license. Safety revocation is different: once the extension receives its safety list, it can disable an installed package.

When you publish, you are stating all of the following.

• The package is yours to publish. You wrote it, or you otherwise have the rights.
• It doesn't infringe anyone's copyright, trademark, patent, or other rights.
• It contains no credentials, API keys, tokens, or private data belonging to anyone, including you.
• No employment agreement or other contract you're under prohibits publishing it.
• You will comply with applicable law, your account authorization, and the target site's terms and restrictions.

If one of those turns out to be false and defending it costs this project money, that cost is yours.

By publishing a community submission, you agree that your package is offered to everyone under CC0 1.0. That is as close to the public domain as a license gets. Anyone can copy a package, change it, ship it inside a commercial product, and owe nothing, attribution included.

This is deliberate. A package is a small JSON document injected into a live page, and it exists to be copied.

First-party curated packages are MIT, as documented in the README. Open-source licenses govern software copying, modification, and distribution; these Terms govern the hosted service, registry publishing, and service-connected use.

This list exists so there's no argument later.

• Packages that attack the site they target or the person running them. That includes harvesting credentials, sending page data somewhere the user didn't ask for, and writes the tool description doesn't admit to.
• Anything illegal, or built to help someone else do something illegal.
• Packages designed to bypass access controls, evade blocks or rate limits, conceal writes, or access accounts or data without authorization.
• Spam, packages published to bury a rival, or packages published to sit on a domain name.
• Malware of any description, including a harmless v1 followed by a hostile v2.

The same list covers the API. Don't hammer it either. Reads are unauthenticated today, and that can change.

During beta, removal requests are handled manually. After a publisher or legal request, or when a package is dangerous, we may remove its public listing or access. A safety revocation can disable an installed package once the extension receives the safety list. The usual reasons are the list above, a credible legal complaint, or danger to people who installed a package.

You can ask us to remove public access to your own package. Removal doesn't undo section 3 or section 5. Copies already distributed stay licensed; removing public access does not necessarily affect local copies, while safety revocation can disable them.

For private reports, takedowns, or legal requests, email legal@webmcp.today. For non-sensitive reports, you can also open an issue on the repository. Include a link to the package and enough detail to act on.

The registry, the API, and the extension are provided as they are, with no warranty of any kind.

Packages are written by strangers and nothing checks them before they go live. A package registers tools on pages you're signed into, so read the tools listed on its page before you install it. If a package breaks a site, loses your data, gets your account limited, or does something you didn't expect, that is the risk you took by installing it.

Uptime is not promised. This is a public beta and could stop existing.

To the fullest extent the law allows, Robert Niimi is not liable for indirect, incidental, or consequential damages arising from this registry, a package published on it, or the extension. Where liability can't be excluded, the total is capped at 100 USD or what you have paid to use the service, whichever is greater. Today you pay nothing to use it.

We may change these terms. The date at the top is the version you're reading, and every edit to it is visible in the repository's public history. Using the site after a change means you accept the terms as they stand.

Email legal@webmcp.today for private reports, takedowns, or legal requests. Public GitHub issues remain available for non-sensitive reports.