What you're agreeing to.

WebMCP Cafe is a registry of tool packages written by the public. A package is a JSON document that tells a browser extension how to register tools on a site the package's author doesn't control. Robert Niimi runs the registry. It isn't affiliated with, endorsed by, or operated with the involvement of any site a package targets.

There is no review queue. A package goes live the moment it validates against the schema.

You need an account to publish or install. Anything done with your account, or with an API key created under it, is your responsibility. Treat a key like a password and delete it at Settings → Security if it leaks.

You have to be old enough to agree to a contract where you live.

Publish a package, through the form or by POSTing to the API, and you grant Robert Niimi a worldwide, non-exclusive, irrevocable, perpetual, royalty-free license to host, store, reproduce, modify, adapt, publish, distribute, and redistribute it, and to sublicense all of that to anyone using the registry. In practice that means the extension, the MCP server, the public API, and anyone reading the API directly.

You keep your copyright. This is a license, not a handover. Your own work stays yours to use anywhere else, under any terms you like.

Irrevocable is doing real work in that sentence. Versions here are append-only and every install pins to a specific version, so anyone who installed your package is already running a copy you can't call back. You can have a package taken down from the registry (section 7), but the license on copies already distributed stands.

When you publish, you are stating all of the following.

• The package is yours to publish. You wrote it, or you otherwise have the rights.
• It doesn't infringe anyone's copyright, trademark, patent, or other rights.
• It contains no credentials, API keys, tokens, or private data belonging to anyone, including you.
• No employment agreement or other contract you're under prohibits publishing it.

If one of those turns out to be false and defending it costs this project money, that cost is yours.

By publishing, you agree that your package is offered to everyone under CC0 1.0. That is as close to the public domain as a license gets. Anyone can copy a package, change it, ship it inside a commercial product, and owe nothing, attribution included.

This is deliberate. A package is a small JSON document injected into a live page, and it exists to be copied.

The code that runs the registry is licensed separately, and split across the repository. The README says which part is under which license.

Most of this is obvious. It's written down so there's no argument later.

• Packages that attack the site they target or the person running them. No credential harvesting, no sending page data somewhere the user didn't ask for, no writes the tool description doesn't admit to.
• Anything illegal, or built to help someone else do something illegal.
• Spam, packages published to bury a rival, or packages published to sit on a domain name.
• Malware of any description, including a harmless v1 followed by a hostile v2.

The same list covers the API. Don't hammer it either. Reads are unauthenticated today as a courtesy, not a promise.

Anything here can be removed at any time, without notice, and an account can be suspended the same way. The usual reasons are the list above, a credible legal complaint, or a package that turns out to be dangerous to the people who installed it.

You can ask for your own package to be removed and it will be. Removal doesn't undo section 3 or section 5. Copies already distributed stay licensed, and anyone pinned to a version keeps running it until they move the pin.

To report a package or ask for a takedown, open an issue on the repository. Include a link to the package and enough detail to act on.

The registry, the API, and the extension are provided as they are, with no warranty of any kind.

Packages are written by strangers and nothing checks them before they go live. A package registers tools on pages you're signed into, so read the tools listed on its page before you install it. If a package breaks a site, loses your data, gets your account limited, or does something you didn't expect, that is the risk you took by installing it.

Nothing about uptime is promised. This project is pre-launch and could stop existing.

To the fullest extent the law allows, Robert Niimi is not liable for indirect, incidental, or consequential damages arising from this registry, a package published on it, or the extension. Where liability can't be excluded, the total is capped at 100 USD or what you have paid to use the service, whichever is greater. Today that is nothing. The registry is free.

These terms will change, especially before launch. The date at the top is the version you're reading, and every edit to it is visible in the repository's public history. Using the site after a change means you accept the terms as they stand.

Open an issue on the repository.