active_webmcp 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 8f08c4bcae7954bc89775cb6d930aa1d26f862e8d0b99e51257c814c8a24cd52
+  data.tar.gz: 33f7fcbd7405270ef9880809d673150a31c71b939c57a914402a72e21d8f9bde
+SHA512:
+  metadata.gz: 647e2f2d323ce910501d46c1bfab3a9d21a49273931029a7c0f985e8e805a56576dc257224d02e6bd57f4900cb05edbf4e94a16a091904a3bbf47c2807c409b1
+  data.tar.gz: 3d378d826938e3babcf7426b4052870fe37a7d69d57c10fe0bfaa0192bf99752b1a5ce6bb4cbbc8c1401bda0a53f9318a73a6b6f3a88c6610c2b7c6e5b9cf201

data/CHANGELOG.md

@@ -0,0 +1,32 @@
+# Changelog
+
+## 0.1.0 — 2026-09-01
+
+- Explicit controller declarations and page-selected public tool names; local and
+  explicit cross-controller lookup, immutable schemas and Rails reload support.
+- Flat string/integer/number/boolean parameters with descriptions, required fields
+  and enums; strict validation, no coercion or agent-controlled routing.
+- Named same-origin GET/POST JSON execution with Rails sessions and current CSRF.
+- `{ status, httpStatus, data, error }` results, 202/204 handling, blocked redirects,
+  safe error codes, transfer-wide configurable timeout and unknown write outcomes.
+- Native WebMCP adapter, document ownership, Turbo Drive/cache restoration,
+  cleanup independent of execution cancellation, and unsupported-browser fallback.
+- Optional human-readable tool titles plus read-only and untrusted-content
+  annotations from the current WebMCP draft.
+- Idempotent Rails 8.1 importmap/Propshaft installer; nonce CSP and production
+  precompiled assets verified on the pinned setup.
+- Search/favourite examples and request, Node and pinned native-browser checks.
+- Local gem-package installation verification with isolated gem home and fresh
+  Rails app; no package publication is performed by verification scripts.
+
+### Changes during development
+
+The first development implementation returned raw endpoint JSON to a native caller. This release instead
+wraps it under `data`; the Rails HTTP response format is unchanged.
+
+### Known limits
+
+Pinned experimental Chrome only; no polyfill, separate MCP server, UI updates,
+navigation execution, forms, dynamic paths, nested inputs, Frames/Streams,
+framework adapters or API-only/cross-origin integration. Browser replay requires
+application deduplication. MIT licensed.

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 zbin.song@gmail.com
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,284 @@
+# ActiveWebMCP
+
+[![CI](https://github.com/benjis/Active_WebMCP/actions/workflows/ci.yml/badge.svg)](https://github.com/benjis/Active_WebMCP/actions/workflows/ci.yml)
+
+Turn selected Rails controller actions into tools that browser-based AI agents
+can discover and call.
+
+ActiveWebMCP keeps your application in control. Your existing Rails actions still
+handle authentication, authorization, validation, database writes, and JSON
+responses. You do not need a separate MCP server or handwritten registration
+JavaScript.
+
+## Status and WebMCP support
+
+`0.1.0` is the current release.
+
+WebMCP does not currently have numbered protocol releases. ActiveWebMCP targets
+the [W3C WebMCP Draft Community Group Report dated 26 August 2026](https://webmachinelearning.github.io/webmcp/),
+at upstream revision
+[`41d12f0`](https://github.com/webmachinelearning/webmcp/commit/41d12f057167ccf5954dbcf49d99502cb6c84491).
+It supports the draft's imperative `document.modelContext` API:
+
+- tool registration with `name`, `title`, `description`, `inputSchema`,
+  `annotations`, and `execute`
+- registration cleanup with `AbortSignal`
+- execution cancellation with `AbortSignal`
+- JSON-serializable tool results
+
+This release is tested with Chrome for Testing `153.0.8010.12` on Apple
+Silicon macOS. Chrome exposes WebMCP experimentally; it is not yet a stable,
+widely available browser API. ActiveWebMCP does not currently support declarative
+form tools or cross-origin tool exposure.
+
+## Requirements
+
+- Ruby 3.3 or newer
+- Rails 8.1
+- importmap-rails
+- Propshaft
+- a browser with the experimental WebMCP API
+
+The tested Rails stack is Ruby `3.3.12`, Rails `8.1.3.1`, importmap-rails `2.2.3`,
+and Propshaft `1.3.2`.
+
+## Quick start
+
+### 1. Add the gem
+
+For development from a nearby checkout:
+
+```ruby
+# Gemfile
+gem "active_webmcp", path: "../Active_WebMCP"
+```
+
+For the published `0.1.0` release:
+
+```ruby
+# Gemfile
+gem "active_webmcp", "0.1.0"
+```
+
+Then install the JavaScript entrypoint and importmap pins:
+
+```sh
+bundle install
+bin/rails generate active_webmcp:install
+```
+
+The generator is safe to run more than once. It stops without changing files if
+it finds an importmap conflict or an unsupported layout.
+
+### 2. Declare a read tool
+
+Start with an existing controller action that returns JSON:
+
+```ruby
+class HotelsController < ApplicationController
+  webmcp_tool :search,
+    name: "search_hotels",
+    title: "Search hotels",
+    description: "Search hotels by destination. Does not book or pay.",
+    read_only_hint: true,
+    untrusted_content_hint: true,
+    route: :search_hotels,
+    method: :get,
+    parameters: {
+      destination: {
+        type: :string,
+        required: true,
+        description: "City or region"
+      }
+    }
+
+  def search
+    hotels = Hotel.where(destination: params.require(:destination))
+    render json: { hotels: hotels.as_json(only: %i[id name destination]) }
+  end
+end
+```
+
+Use a named route:
+
+```ruby
+# config/routes.rb
+get "/hotels/search", to: "hotels#search", as: :search_hotels
+```
+
+### 3. Select the tool on a page
+
+A declared tool is not exposed automatically. Select it in the view where it
+should be available:
+
+```erb
+<%= webmcp_tools "search_hotels" %>
+```
+
+That is enough. ActiveWebMCP renders safe JSON metadata and registers the tool
+when the page loads. If WebMCP is unavailable, the rest of the page continues to
+work normally.
+
+### Optional tool metadata
+
+Use `title` as a short label that a browser or agent can show to a person. The
+description can remain a fuller explanation of what the tool does.
+
+Two optional annotations describe expected behaviour:
+
+- `read_only_hint: true` says the tool should not change application state.
+- `untrusted_content_hint: true` says the result may include content that should
+  not be treated as trusted instructions.
+
+These annotations are hints for clients. They do not enforce permissions,
+sandbox content, or replace authentication, authorization, and input validation.
+
+## Write tool example
+
+POST tools use the same Rails session and CSRF protection as the rest of your app:
+
+```ruby
+class FavouritesController < ApplicationController
+  before_action :authenticate_user!
+
+  webmcp_tool :create,
+    name: "add_favourite",
+    title: "Add favourite",
+    description: "Save a hotel to the current user's favourites. Does not book it.",
+    route: :favourites,
+    method: :post,
+    parameters: {
+      hotel_id: { type: :integer, required: true }
+    }
+
+  def create
+    favourite = current_user.favourites.create_or_find_by!(
+      hotel_id: params.require(:hotel_id)
+    )
+
+    render json: { hotel_id: favourite.hotel_id, saved: true }
+  end
+end
+```
+
+```ruby
+# config/routes.rb
+post "/favourites", to: "favourites#create", as: :favourites
+```
+
+Select a tool from another controller explicitly:
+
+```erb
+<%= webmcp_tools "add_favourite", controller: FavouritesController %>
+```
+
+ActiveWebMCP reads the current CSRF token when the agent invokes the tool. Rails
+must still authenticate the user, authorize the record, and validate every input.
+Use database constraints or another idempotency strategy for writes because a
+browser or network intermediary may replay a POST.
+
+## Supported parameters
+
+ActiveWebMCP intentionally supports a small, predictable schema:
+
+| Type | Ruby declaration | Example value |
+| --- | --- | --- |
+| String | `type: :string` | `"Sydney"` |
+| Integer | `type: :integer` | `42` |
+| Number | `type: :number` | `12.5` |
+| Boolean | `type: :boolean` | `true` |
+
+Each parameter can use `required`, `description`, and a type-matching `enum`.
+Nested objects, arrays, default values, silent type conversion, and unknown input
+fields are rejected.
+
+## Tool results
+
+The Rails action owns the JSON inside `data`. ActiveWebMCP wraps it in a small
+result envelope:
+
+```json
+{
+  "status": "completed",
+  "httpStatus": 200,
+  "data": {
+    "hotels": [
+      { "id": 1, "name": "Harbour Hotel", "destination": "Sydney" }
+    ]
+  },
+  "error": null
+}
+```
+
+`status` can be `completed`, `accepted`, `failed`, or `unknown`. An interrupted
+write can be `unknown` because a timeout cannot prove whether the server committed
+the change. ActiveWebMCP never retries a tool request automatically.
+
+## Configuration
+
+The default timeout is 30 seconds. Change it in an initializer:
+
+```ruby
+# config/initializers/active_webmcp.rb
+Rails.application.config.active_webmcp.timeout_ms = 10_000
+```
+
+Keep these Rails helpers in your layout:
+
+```erb
+<%= csrf_meta_tags %>
+<%= csp_meta_tag %>
+<%= javascript_importmap_tags %>
+```
+
+The installer does not weaken your Content Security Policy.
+
+## Important boundaries
+
+- Only explicitly selected tools are visible on a page.
+- Only named, same-origin GET and POST routes are supported.
+- Dynamic path segments and wildcard routes are not supported.
+- Authentication and authorization remain application responsibilities.
+- Tool annotations are advisory metadata, not security controls.
+- Tool descriptions and results may contain untrusted text.
+- Turbo Drive navigation and page restoration are supported.
+- Turbo Frames, Streams, morph navigation, and custom routers are not supported.
+- Missing WebMCP support must not replace or break the human interface.
+
+See [SECURITY.md](SECURITY.md) before exposing actions that read private data or
+change application state.
+
+## Development
+
+Run the fast Ruby and JavaScript suites:
+
+```sh
+bundle exec ruby bin/test
+npm test
+bundle exec rubocop
+```
+
+The Ruby suite uses RSpec. The JavaScript suite uses Node's built-in test runner.
+
+Native browser tests require the pinned Apple Silicon Chrome build:
+
+```sh
+ruby bin/setup-browser
+bundle exec ruby bin/test --native
+```
+
+Release verification builds isolated Rails applications and a real gem artifact:
+
+```sh
+bundle exec ruby bin/check-clean-install
+bundle exec ruby bin/check-production
+bundle exec ruby bin/check-package
+```
+
+The demonstration Rails application lives in `test/dummy` and contains only
+synthetic users and records. It is never included in the gem.
+
+## License
+
+ActiveWebMCP is available under the [MIT License](LICENSE). See
+[CHANGELOG.md](CHANGELOG.md) for release changes.

data/SECURITY.md

@@ -0,0 +1,65 @@
+# Security guidance
+
+ActiveWebMCP is an experimental browser enhancement, not an authorization layer.
+Security reports should be submitted privately through
+[GitHub Security Advisories](https://github.com/benjis/Active_WebMCP/security/advisories/new).
+Do not put tokens, personal records, private responses or exploit details into a
+public issue.
+
+## Application responsibilities
+
+- Authenticate every request, authorize the record and tenant, validate input and
+  enforce transactions. Tool visibility and descriptions are not permission grants.
+- Keep Rails CSRF protection enabled and render current `csrf_meta_tags`. The gem
+  reads the token at invocation time; it cannot repair expired sessions or tokens.
+- Use named GET routes only for reads and named POST routes for writes. Never put
+  writes behind GET. Preserve authorization for human and agent callers alike.
+- Return only JSON you intend the caller/agent to see, including error responses.
+  The gem preserves application JSON under `data`; it does not redact it for you.
+- Scope record queries and uniqueness constraints appropriately. The fixture's
+  `create_or_find_by!` and unique index are an example, not general idempotency for
+  arbitrary operations. Payments, refunds and irreversible actions are out of scope.
+- Avoid shared caches for session-specific pages/CSRF metadata. Old browser snapshots
+  are not proof of current authorization. Own cache invalidation on identity changes.
+- Configure Rails/application/proxy log filtering. Gem diagnostics contain static
+  codes; this does not control Rails request logs, browser logs or agent traces.
+
+## Transport and outcomes
+
+Each dispatched invocation makes one gem-level `fetch`. There is no automatic
+retry, UI refresh request or rollback. A browser can transparently replay a POST
+inside that fetch; design application-owned deduplication for duplicate delivery.
+
+Timeout, cancellation or a lost/invalid successful POST response can leave the
+outcome `unknown`. Do not blindly resubmit. A native caller's cancellation may
+prevent delivery of any final envelope. A non-success HTTP status is not proof
+that a transaction rolled back. HTTP 202 is accepted, not completed.
+
+Requests use same-origin credentials, JSON Accept and manual redirects. Missing
+CSRF prevents POST dispatch. Server-side CSRF and access checks remain mandatory.
+Never supply routing decisions from agent inputs. The alpha rejects dynamic paths,
+wildcards, cross-origin endpoints and reserved routing parameters.
+
+## Browser, CSP and agent boundary
+
+Only selected tool metadata is emitted, as escaped inert JSON. Executable code is
+in packaged external modules; there is no eval or inline callback. Applications
+own CSP. Rails importmap's inline bootstrap still needs an approved nonce/hash
+policy; do not disable CSP just to make tools load.
+
+Page text and tool results can contain prompt injection. This gem does not make
+untrusted text safe instructions, constrain an agent's reasoning, or implement
+confirmation for sensitive actions. A hostile same-origin script/extension is
+outside this library's isolation guarantees.
+
+Use pinned test browsers with isolated profiles. Inspector requests broad host
+access and can retain its Gemini key: use fixture data only. Configure credentials
+through Inspector's UI, never in source, CLI arguments, committed files or chat.
+Keep profiles out of version control and rotate temporary test credentials.
+
+## Reporting
+
+Provide the gem/browser/Rails versions, affected boundary, sanitized reproduction
+and whether a business write may have committed. Do not send real credentials or
+tenant/customer data. Submitting a report does not create a guaranteed response
+time or support commitment.

data/app/assets/javascripts/active_webmcp/runtime.js

@@ -0,0 +1,262 @@
+// Internal implementation. Only native WebMCP access lives in this adapter.
+export class WebMCPAdapter {
+  constructor(document) { this.document = document; }
+
+  available() {
+    const context = this.document.modelContext;
+    return typeof context?.registerTool === "function" && typeof context?.getTools === "function";
+  }
+
+  async register(definition, execute) {
+    const lifetime = new AbortController();
+    const tool = { name: definition.name, description: definition.description,
+      inputSchema: definition.inputSchema, execute };
+    if (own(definition, "title")) tool.title = definition.title;
+    if (own(definition, "annotations")) tool.annotations = definition.annotations;
+    try {
+      await this.document.modelContext.registerTool(tool, { signal: lifetime.signal });
+    } catch (error) {
+      lifetime.abort();
+      throw error;
+    }
+    // This lifetime is NOT the execution callback's signal.
+    return () => lifetime.abort();
+  }
+}
+
+class ExecutionError extends Error {
+  constructor(code) {
+    super(`ActiveWebMCP: ${code}`);
+    this.name = "ActiveWebMCPError";
+    this.code = code;
+  }
+}
+
+const own = (object, key) => Object.prototype.hasOwnProperty.call(object, key);
+const scalar = (type, value) => {
+  switch (type) {
+    case "string": return typeof value === "string";
+    case "boolean": return typeof value === "boolean";
+    case "integer": return Number.isSafeInteger(value);
+    case "number": return typeof value === "number" && Number.isFinite(value);
+    default: return false;
+  }
+};
+const reserved = new Set(["controller", "action", "format", "host", "protocol", "port", "url", "origin", "path",
+  "method", "script_name", "authenticity_token", "_method", "utf8", "__proto__", "prototype", "constructor"]);
+
+function validateInput(schema, input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) throw new ExecutionError("invalid_input");
+  for (const name of schema.required) {
+    if (!own(input, name)) throw new ExecutionError("missing_parameter");
+  }
+  for (const [name, value] of Object.entries(input)) {
+    if (!own(schema.properties, name)) throw new ExecutionError("unknown_parameter");
+    const property = schema.properties[name];
+    if (!scalar(property.type, value)) throw new ExecutionError("invalid_parameter_type");
+    if (property.enum && !property.enum.includes(value)) throw new ExecutionError("invalid_parameter_enum");
+  }
+}
+
+function validateDefinition(definition, location) {
+  if (!definition || typeof definition.name !== "string" || !/^[a-zA-Z0-9_.-]{1,128}$/.test(definition.name) ||
+      typeof definition.description !== "string" || !definition.description.trim()) throw new ExecutionError("invalid_manifest");
+  if (own(definition, "title") && (typeof definition.title !== "string" || !definition.title.trim())) {
+    throw new ExecutionError("invalid_manifest");
+  }
+  validateAnnotations(definition);
+  const endpoint = definition.endpoint;
+  if (!["GET", "POST"].includes(endpoint?.method) || typeof endpoint.path !== "string" || !/^\/(?!\/)/.test(endpoint.path) ||
+      /[\\?#\x00-\x20]/.test(endpoint.path)) throw new ExecutionError("invalid_endpoint");
+  const url = new URL(endpoint.path, location.href);
+  if (url.origin !== location.origin) throw new ExecutionError("cross_origin_endpoint");
+  if (own(definition, "timeoutMs") && !validTimeout(definition.timeoutMs)) throw new ExecutionError("invalid_timeout");
+  const schema = definition.inputSchema;
+  if (schema?.type !== "object" || schema.additionalProperties !== false || !schema.properties ||
+      typeof schema.properties !== "object" || Array.isArray(schema.properties) || !Array.isArray(schema.required)) {
+    throw new ExecutionError("invalid_schema");
+  }
+  for (const name of schema.required) {
+    if (typeof name !== "string" || !own(schema.properties, name)) throw new ExecutionError("invalid_schema");
+  }
+  for (const [name, property] of Object.entries(schema.properties)) {
+    if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name) || reserved.has(name) || !property ||
+        !["string", "number", "integer", "boolean"].includes(property.type)) throw new ExecutionError("invalid_schema");
+    if (own(property, "enum") && (!Array.isArray(property.enum) || !property.enum.length ||
+        !property.enum.every(value => scalar(property.type, value)))) throw new ExecutionError("invalid_schema");
+  }
+}
+
+function validateAnnotations(definition) {
+  if (!own(definition, "annotations")) return;
+  const annotations = definition.annotations;
+  if (!annotations || typeof annotations !== "object" || Array.isArray(annotations)) {
+    throw new ExecutionError("invalid_manifest");
+  }
+  const supported = new Set(["readOnlyHint", "untrustedContentHint"]);
+  for (const [name, value] of Object.entries(annotations)) {
+    if (!supported.has(name) || typeof value !== "boolean") throw new ExecutionError("invalid_manifest");
+  }
+}
+
+const validTimeout = value => Number.isInteger(value) && value > 0 && value <= 2147483647;
+const messages = Object.freeze({
+  invalid_input: "Input must be a flat object.",
+  missing_parameter: "A required parameter is missing.",
+  unknown_parameter: "An unknown parameter was supplied.",
+  invalid_parameter_type: "A parameter has an invalid type.",
+  invalid_parameter_enum: "A parameter is outside its allowed values.",
+  missing_csrf: "A current Rails CSRF token is required before sending this write.",
+  invalid_csrf: "The Rails CSRF token cannot be used as a request header.",
+  http_error: "The server returned an unsuccessful HTTP status.",
+  redirect_blocked: "Redirects are not followed in JSON execution mode.",
+  non_json_response: "The server did not return a JSON response.",
+  invalid_json: "The server returned malformed JSON.",
+  timeout: "The request exceeded its time limit.",
+  cancelled: "The invocation was cancelled.",
+  request_failed: "The request or response transfer could not be completed."
+});
+function result(status, httpStatus = null, data = null, code = null) {
+  return { status, httpStatus, data, error: code ? { code,
+    message: (messages[code] || messages.request_failed) +
+      (status === "unknown" ? " The write outcome is unknown; do not automatically retry." : "") } : null };
+}
+
+// HTTP evidence is separate from business outcome. Never infer rollback from an
+// interrupted write, and never change the application's JSON representation.
+async function execute(definition, input, signal, { document, fetch, location, timeoutMs }) {
+  const request = new AbortController();
+  let dispatched = false;
+  let httpStatus = null;
+  let timeout;
+  let cancel;
+  let interruption;
+  const isWrite = definition.endpoint.method === "POST";
+  const incompleteStatus = () => {
+    if (httpStatus === 202) return "accepted";
+    if (httpStatus !== null && (httpStatus < 200 || httpStatus >= 300)) return "failed";
+    return isWrite && dispatched ? "unknown" : "failed";
+  };
+  try {
+    validateInput(definition.inputSchema, input);
+    if (signal?.aborted) throw new ExecutionError("cancelled");
+    const url = new URL(definition.endpoint.path, location.href);
+    const options = { method: definition.endpoint.method, credentials: "same-origin", redirect: "manual",
+      headers: { Accept: "application/json" }, signal: request.signal };
+    if (isWrite) {
+      // Read at invocation time, not when the page tools were registered.
+      const token = document.querySelector('meta[name="csrf-token"]')?.getAttribute("content");
+      if (typeof token !== "string" || !token.trim()) throw new ExecutionError("missing_csrf");
+      if (/[^\x20-\x7e]/.test(token)) throw new ExecutionError("invalid_csrf");
+      options.headers["X-CSRF-Token"] = token;
+      options.headers["Content-Type"] = "application/json";
+      options.body = JSON.stringify(Object.fromEntries(Object.entries(input)));
+    } else {
+      for (const [name, value] of Object.entries(input)) url.searchParams.set(name, String(value));
+    }
+    const interrupted = new Promise((_resolve, reject) => {
+      const abort = code => {
+        interruption ||= code;
+        request.abort();
+        reject(new ExecutionError(interruption));
+      };
+      cancel = () => abort("cancelled");
+      signal?.addEventListener("abort", cancel, { once: true });
+      timeout = setTimeout(() => abort("timeout"), definition.timeoutMs ?? timeoutMs);
+    });
+    const transfer = async () => {
+      dispatched = true;
+      // Exactly one fetch per dispatch. Browsers/transports can still replay a
+      // POST internally; duplicate business effects must be prevented by the app.
+      const response = await fetch(url.href, options);
+      if (Number.isInteger(response.status) && response.status >= 100 && response.status <= 599) httpStatus = response.status;
+      // Chrome exposes blocked redirects as opaque responses (no visible status).
+      if (response.type === "opaqueredirect" || response.redirected ||
+          (response.status >= 300 && response.status < 400)) throw new ExecutionError("redirect_blocked");
+      if (httpStatus === null) throw new ExecutionError("request_failed");
+      if (request.signal.aborted) throw new ExecutionError(interruption);
+      if (httpStatus === 204) return result("completed", httpStatus);
+      const mediaType = (response.headers.get("Content-Type") || "").split(";", 1)[0].trim().toLowerCase();
+      if (mediaType !== "application/json" && !/^application\/[a-z0-9.+-]+\+json$/.test(mediaType)) {
+        throw new ExecutionError("non_json_response");
+      }
+      let data;
+      try { data = await response.json(); }
+      catch (error) {
+        if (request.signal.aborted) throw new ExecutionError(interruption);
+        throw new ExecutionError(error instanceof SyntaxError ? "invalid_json" : "request_failed");
+      }
+      if (request.signal.aborted) throw new ExecutionError(interruption);
+      if (!response.ok) return result("failed", httpStatus, data, "http_error");
+      return result(httpStatus === 202 ? "accepted" : "completed", httpStatus, data);
+    };
+    // Includes body transfer, not merely receipt of the HTTP response headers.
+    return await Promise.race([transfer(), interrupted]);
+  } catch (error) {
+    const code = interruption || (error instanceof ExecutionError ? error.code : "request_failed");
+    return result(incompleteStatus(), httpStatus, null, code);
+  } finally {
+    clearTimeout(timeout);
+    if (cancel) signal?.removeEventListener("abort", cancel);
+  }
+}
+
+export function createRuntime({ document, location, fetch, adapter = new WebMCPAdapter(document),
+  logger = console, timeoutMs = 30000 }) {
+  if (!validTimeout(timeoutMs)) throw new TypeError("timeoutMs must be an integer from 1 to 2147483647");
+  const owned = new Map();
+  let generation = 0;
+  let queue = Promise.resolve();
+  const warn = code => logger.warn(`[ActiveWebMCP] ${code}`);
+  const release = () => {
+    for (const tool of owned.values()) tool.dispose();
+    owned.clear();
+  };
+  const dispose = () => { generation++; release(); };
+
+  function refresh() {
+    const revision = ++generation;
+    queue = queue.then(async () => {
+      if (revision !== generation) return;
+      let selected;
+      try {
+        if (!adapter.available()) { release(); return; }
+        selected = new Map();
+        for (const block of document.querySelectorAll('script[type="application/json"][data-active-webmcp]')) {
+          const definitions = JSON.parse(block.textContent);
+          if (!Array.isArray(definitions)) throw new ExecutionError("invalid_manifest");
+          for (const definition of definitions) {
+            validateDefinition(definition, location);
+            const fingerprint = JSON.stringify(definition);
+            if (selected.has(definition.name) && selected.get(definition.name).fingerprint !== fingerprint) {
+              throw new ExecutionError("conflicting_page_tools");
+            }
+            selected.set(definition.name, { definition, fingerprint });
+          }
+        }
+      } catch {
+        release(); warn("invalid_page_manifest"); return;
+      }
+      for (const [name, tool] of owned) {
+        if (selected.get(name)?.fingerprint !== tool.fingerprint) {
+          tool.dispose(); owned.delete(name);
+        }
+      }
+      for (const [name, { definition, fingerprint }] of selected) {
+        if (revision !== generation) return;
+        if (owned.has(name)) continue;
+        try {
+          const cleanup = await adapter.register(definition, (input, { signal } = {}) =>
+            execute(definition, input, signal, { document, fetch, location, timeoutMs }));
+          if (revision !== generation) { cleanup(); return; }
+          owned.set(name, { fingerprint, dispose: cleanup });
+        } catch {
+          // registerTool rejects a collision; never remove or adopt the other owner.
+          warn("registration_failed");
+        }
+      }
+    });
+    return queue;
+  }
+  return { refresh, dispose };
+}

data/app/assets/javascripts/active_webmcp.js

@@ -0,0 +1,21 @@
+import { createRuntime } from "active_webmcp/runtime";
+
+// One owner per document, even if an entrypoint is initialized more than once.
+const key = Symbol.for("active_webmcp.runtime");
+if (!globalThis[key]) {
+  const runtime = createRuntime({ document, location, fetch: globalThis.fetch.bind(globalThis) });
+  globalThis[key] = runtime;
+  document.addEventListener("DOMContentLoaded", () => runtime.refresh());
+  window.addEventListener("pageshow", () => runtime.refresh());
+  window.addEventListener("pagehide", () => runtime.dispose());
+  // Turbo Drive replaces the body without replacing this document's runtime.
+  // Keep previews inactive; reconcile on the completed visit (including cached
+  // restoration). Frames, Streams and custom routers are not supported here.
+  document.addEventListener("turbo:before-cache", () => runtime.dispose());
+  document.addEventListener("turbo:before-render", () => runtime.dispose());
+  document.addEventListener("turbo:load", () => runtime.refresh());
+}
+const runtime = globalThis[key];
+export const refresh = () => runtime.refresh();
+export const dispose = () => runtime.dispose();
+refresh();

data/lib/active_webmcp/controller.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module ActiveWebMCP
+  # Adds immutable WebMCP tool declarations to Rails controllers.
+  module Controller
+    extend ActiveSupport::Concern
+
+    included do
+      class_attribute :webmcp_definitions, instance_writer: false, default: {}.freeze
+    end
+
+    class_methods do
+      def webmcp_tool(action, **options)
+        definition = ToolDefinition.new(action, **options)
+        if webmcp_definitions.key?(definition.name)
+          raise ConfigurationError, "tool already declared (possibly inherited): #{definition.name}"
+        end
+
+        self.webmcp_definitions = webmcp_definitions.merge(definition.name => definition).freeze
+        definition
+      rescue ArgumentError => e
+        raise e if e.is_a?(ConfigurationError)
+
+        raise ConfigurationError, "invalid webmcp_tool declaration: #{e.message}"
+      end
+    end
+  end
+end

data/lib/active_webmcp/engine.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module ActiveWebMCP
+  # Hooks ActiveWebMCP into Rails controllers and views.
+  class Engine < ::Rails::Engine
+    config.active_webmcp = ActiveSupport::OrderedOptions.new
+    config.active_webmcp.timeout_ms = 30_000
+
+    initializer "active_webmcp.controller" do
+      ActiveSupport.on_load(:action_controller_base) { include ActiveWebMCP::Controller }
+      ActiveSupport.on_load(:action_view) { include ActiveWebMCP::PageHelper }
+    end
+  end
+end

data/lib/active_webmcp/page_helper.rb

@@ -0,0 +1,99 @@
+# frozen_string_literal: true
+
+module ActiveWebMCP
+  # Renders selected controller tools as inert JSON metadata.
+  module PageHelper
+    def webmcp_tools(*names, controller: self.controller.class)
+      validate_controller!(controller)
+      timeout = configured_timeout
+      manifests = names.map(&:to_s).uniq.map { |name| manifest_for(controller, name, timeout) }
+      # JSON escaping prevents </script>, HTML and Unicode separators from escaping
+      # this inert data block. No user/request data is retained on controller classes.
+      tag.script(ERB::Util.json_escape(manifests.to_json).html_safe,
+                 type: "application/json", data: { active_webmcp: true })
+    end
+
+    private
+
+    def validate_controller!(controller)
+      valid = controller.is_a?(Class) && controller <= ActionController::Base
+      valid &&= controller.respond_to?(:webmcp_definitions)
+      raise ConfigurationError, "controller: must be a Rails controller class" unless valid
+    end
+
+    def configured_timeout
+      timeout = Rails.application.config.active_webmcp.timeout_ms
+      return timeout if timeout.is_a?(Integer) && timeout.between?(1, 2_147_483_647)
+
+      raise ConfigurationError, "config.active_webmcp.timeout_ms must be an integer from 1 to 2147483647"
+    end
+
+    def manifest_for(controller, name, timeout)
+      definition = controller.webmcp_definitions.fetch(name) do
+        raise ConfigurationError, "tool not declared on #{controller.name}: #{name}"
+      end
+      manifest = { name: definition.name, description: definition.description, inputSchema: definition.schema,
+                   timeoutMs: timeout,
+                   endpoint: { path: active_webmcp_path(controller, definition), method: definition.method } }
+      manifest[:title] = definition.title if definition.title
+      manifest[:annotations] = definition.annotations if definition.annotations
+      manifest
+    end
+
+    def active_webmcp_path(controller_class, definition)
+      routes = Rails.application.routes
+      route = declared_route!(routes, definition)
+      validate_route!(route, controller_class, definition)
+      path = public_send("#{definition.route}_path")
+      validate_generated_path!(path, definition)
+      validate_recognition!(routes, path, controller_class, definition)
+      path
+    rescue ActionController::UrlGenerationError, ActionController::RoutingError
+      raise ConfigurationError, "could not resolve the declared local endpoint: #{definition.route}"
+    end
+
+    def declared_route!(routes, definition)
+      routes.named_routes.get(definition.route.to_sym) ||
+        raise(ConfigurationError, "named route not found: #{definition.route}")
+    end
+
+    def validate_route!(route, controller, definition)
+      validate_public_action!(controller, definition)
+      validate_route_target!(route, controller, definition)
+      validate_static_route!(route, definition)
+    end
+
+    def validate_public_action!(controller, definition)
+      return if controller.action_methods.include?(definition.action)
+
+      raise ConfigurationError, "tool action is not public: #{definition.action}"
+    end
+
+    def validate_route_target!(route, controller, definition)
+      target = [controller.controller_path, definition.action]
+      return if route.defaults.values_at(:controller, :action) == target && route.verb == definition.method
+
+      raise ConfigurationError,
+            "named route does not match the declared controller, action and method: #{definition.route}"
+    end
+
+    def validate_static_route!(route, definition)
+      return if (route.parts - [:format]).empty? && !route.path.spec.to_s.include?("*")
+
+      raise ConfigurationError, "dynamic path segments and wildcard routes are not supported: #{definition.route}"
+    end
+
+    def validate_generated_path!(path, definition)
+      return if path.start_with?("/") && !path.start_with?("//") && !path.match?(/[\\?#\x00-\x20]/)
+
+      raise ConfigurationError, "route must generate a local path without query or fragment: #{definition.route}"
+    end
+
+    def validate_recognition!(routes, path, controller, definition)
+      recognized = routes.recognize_path(path, method: definition.method)
+      return if recognized.values_at(:controller, :action) == [controller.controller_path, definition.action]
+
+      raise ConfigurationError, "named route is shadowed by another endpoint: #{definition.route}"
+    end
+  end
+end

data/lib/active_webmcp/schema_compiler.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+module ActiveWebMCP
+  # Compiles the supported flat parameter declarations into JSON Schema.
+  class SchemaCompiler
+    TYPES = %w[string integer number boolean].freeze
+    OPTIONS = %w[type required description enum].freeze
+    RESERVED = %w[controller action format host protocol port url origin path method script_name
+                  authenticity_token _method utf8 __proto__ prototype constructor].freeze
+    SAFE_INTEGER = (2**53) - 1
+
+    def self.compile(parameters)
+      raise ConfigurationError, "parameters must be a Hash" unless parameters.is_a?(Hash)
+
+      properties = {}
+      required = []
+      parameters.each do |key, declaration|
+        name, property, required_parameter = compile_parameter(key, declaration)
+        raise ConfigurationError, "duplicate parameter: #{name}" if properties.key?(name)
+
+        properties[name] = property
+        required << name if required_parameter
+      end
+      ActiveWebMCP.deep_freeze({ "type" => "object", "properties" => properties,
+                                 "required" => required, "additionalProperties" => false })
+    end
+
+    def self.compile_parameter(key, declaration)
+      name = parameter_name(key)
+      options = parameter_options(name, declaration)
+      type = parameter_type(name, options)
+      validate_required!(name, options)
+      [name, property_schema(name, type, options), options["required"]]
+    end
+
+    def self.parameter_name(key)
+      unless key.is_a?(String) || key.is_a?(Symbol)
+        raise ConfigurationError,
+              "parameter names must be strings or symbols"
+      end
+
+      name = key.to_s
+      return name if name.match?(/\A[a-zA-Z_][a-zA-Z0-9_]*\z/) && !RESERVED.include?(name)
+
+      raise ConfigurationError, "unsupported or reserved parameter name: #{name}"
+    end
+
+    def self.parameter_options(name, declaration)
+      raise ConfigurationError, "parameter #{name} must have a declaration Hash" unless declaration.is_a?(Hash)
+
+      options = declaration.transform_keys(&:to_s)
+      return options if options.size == declaration.size && (options.keys - OPTIONS).empty?
+
+      raise ConfigurationError, "unsupported or duplicate options for parameter #{name}"
+    end
+
+    def self.parameter_type(name, options)
+      type = options["type"].to_s.dup
+      return type if TYPES.include?(type)
+
+      raise ConfigurationError, "unsupported type for parameter #{name}"
+    end
+
+    def self.validate_required!(name, options)
+      return unless options.key?("required") && ![true, false].include?(options["required"])
+
+      raise ConfigurationError, "required must be a boolean for parameter #{name}"
+    end
+
+    def self.property_schema(name, type, options)
+      property = { "type" => type }
+      property["description"] = description(name, options) if options.key?("description")
+      property["enum"] = enum_values(name, type, options) if options.key?("enum")
+      property
+    end
+
+    def self.description(name, options)
+      value = options["description"]
+      raise ConfigurationError, "description must be a string for parameter #{name}" unless value.is_a?(String)
+
+      value.dup
+    end
+
+    def self.enum_values(name, type, options)
+      values = options["enum"]
+      valid = values.is_a?(Array) && !values.empty? && values.all? { |value| valid_value?(type, value) }
+      raise ConfigurationError, "enum must contain values matching the type for parameter #{name}" unless valid
+
+      values.deep_dup.uniq
+    end
+
+    def self.valid_value?(type, value)
+      case type
+      when "string" then value.is_a?(String)
+      when "boolean" then [true, false].include?(value)
+      when "integer" then value.is_a?(Integer) && value.abs <= SAFE_INTEGER
+      when "number" then valid_number?(value)
+      end
+    end
+
+    def self.valid_number?(value)
+      (value.is_a?(Integer) || value.is_a?(Float)) && value.finite? &&
+        (!value.is_a?(Integer) || value.abs <= SAFE_INTEGER)
+    end
+  end
+end

data/lib/active_webmcp/tool_definition.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module ActiveWebMCP
+  # Immutable, validated declaration of one controller-backed browser tool.
+  class ToolDefinition
+    attr_reader :action, :name, :title, :description, :route, :method, :schema, :annotations
+
+    def initialize(action, name:, description:, route:, method:, execution: :json, parameters: {}, title: nil,
+                   read_only_hint: false, untrusted_content_hint: false)
+      validate_identifier_types!(action, name, route)
+      assign_identifiers(action, name, route, method)
+      validate_identifiers!
+      validate_options!(description, execution, title, read_only_hint, untrusted_content_hint)
+      @description = description.dup.freeze
+      @title = title&.dup&.freeze
+      @annotations = compile_annotations(read_only_hint, untrusted_content_hint)
+      @schema = SchemaCompiler.compile(parameters)
+      freeze
+    end
+
+    private
+
+    def assign_identifiers(action, name, route, method)
+      @action = action.to_s.dup.freeze
+      @name = name.to_s.dup.freeze
+      @route = route.to_s.dup.freeze
+      @method = method.to_s.upcase.freeze
+    end
+
+    def validate_identifier_types!(*values)
+      return if values.all? { |value| value.is_a?(String) || value.is_a?(Symbol) }
+
+      raise ConfigurationError, "action, name and route must be strings or symbols"
+    end
+
+    def validate_identifiers!
+      unless @action.match?(/\A[a-zA-Z_][a-zA-Z0-9_]*\z/) && @route.match?(/\A[a-zA-Z_][a-zA-Z0-9_]*\z/)
+        raise ConfigurationError, "action and named route must be identifiers"
+      end
+      return if @name.match?(/\A[a-zA-Z0-9_.-]{1,128}\z/)
+
+      raise ConfigurationError, "tool name must contain 1–128 ASCII letters, digits, dots, underscores or hyphens"
+    end
+
+    def validate_options!(description, execution, title, *hints)
+      validate_description!(description)
+      validate_title!(title)
+      validate_hints!(hints)
+      raise ConfigurationError, "method must be :get or :post" unless %w[GET POST].include?(@method)
+      raise ConfigurationError, "only execution: :json is supported" unless execution.to_s == "json"
+    end
+
+    def validate_description!(description)
+      return if description.is_a?(String) && !description.strip.empty?
+
+      raise ConfigurationError, "tool description must be a nonempty string"
+    end
+
+    def validate_title!(title)
+      return if title.nil? || (title.is_a?(String) && !title.strip.empty?)
+
+      raise ConfigurationError, "tool title must be nil or a nonempty string"
+    end
+
+    def validate_hints!(hints)
+      return if hints.all? { |hint| [true, false].include?(hint) }
+
+      raise ConfigurationError, "tool annotation hints must be true or false"
+    end
+
+    def compile_annotations(read_only_hint, untrusted_content_hint)
+      return if !read_only_hint && !untrusted_content_hint
+
+      { readOnlyHint: read_only_hint, untrustedContentHint: untrusted_content_hint }.freeze
+    end
+  end
+end

data/lib/active_webmcp/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module ActiveWebMCP
+  VERSION = "0.1.0"
+end

data/lib/active_webmcp.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+require "active_support/core_ext/class/attribute"
+require "active_support/core_ext/object/deep_dup"
+require "rails/engine"
+require_relative "active_webmcp/version"
+
+# Controller-defined WebMCP tools for Rails applications.
+module ActiveWebMCP
+  class ConfigurationError < ArgumentError; end
+
+  def self.deep_freeze(value)
+    case value
+    when Hash
+      value.each do |key, item|
+        deep_freeze(key)
+        deep_freeze(item)
+      end
+    when Array
+      value.each { |item| deep_freeze(item) }
+    end
+    value.freeze
+  end
+end
+
+require_relative "active_webmcp/schema_compiler"
+require_relative "active_webmcp/tool_definition"
+require_relative "active_webmcp/controller"
+require_relative "active_webmcp/page_helper"
+require_relative "active_webmcp/engine"

data/lib/generators/active_webmcp/install/install_generator.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+
+module ActiveWebMCP
+  module Generators
+    # Installs the importmap pins and JavaScript entrypoint into a Rails app.
+    class InstallGenerator < Rails::Generators::Base
+      namespace "active_webmcp:install"
+      desc "Install ActiveWebMCP for Rails 8.1 with importmap and Propshaft."
+
+      PINS = { "active_webmcp" => "active_webmcp.js", "active_webmcp/runtime" => "active_webmcp/runtime.js" }.freeze
+
+      def validate_setup
+        validate_dependencies!
+        importmap_path = destination_path("config/importmap.rb")
+        validate_application_files!(importmap_path)
+        @missing_pins = missing_pins(File.read(importmap_path))
+        detect_application_import
+      end
+
+      private
+
+      def validate_dependencies!
+        return if defined?(Propshaft) && defined?(Importmap) && Rails.version.start_with?("8.1.")
+
+        raise Rails::Generators::Error, "ActiveWebMCP requires Rails 8.1, importmap-rails and Propshaft."
+      end
+
+      def validate_application_files!(importmap_path)
+        layout_path = destination_path("app/views/layouts/application.html.erb")
+        valid_layout = File.file?(layout_path) && File.read(layout_path).include?("javascript_importmap_tags")
+        return if File.file?(importmap_path) && valid_layout
+
+        raise Rails::Generators::Error,
+              "Install importmap first; the application layout must use javascript_importmap_tags."
+      end
+
+      def missing_pins(source)
+        PINS.reject { |name, asset| existing_pin?(source, name, asset) }
+      end
+
+      def existing_pin?(source, name, asset)
+        lines = source.lines.grep_v(/^\s*#/).grep(/["']#{Regexp.escape(name)}["']/)
+        return false if lines.empty?
+
+        expected = /^\s*pin\s+["']#{Regexp.escape(name)}["']\s*,\s*to:\s*["']#{Regexp.escape(asset)}["']\s*(?:#.*)?$/
+        return true if lines.one? && lines.first.match?(expected)
+
+        raise Rails::Generators::Error, "Conflicting importmap pin for #{name}; resolve it before installing."
+      end
+
+      def detect_application_import
+        application_path = destination_path("app/javascript/application.js")
+        @application_exists = File.file?(application_path)
+        @import_exists = @application_exists && File.read(application_path)
+                                                    .match?(%r{^\s*import\s+["']active_webmcp["']\s*;?\s*(?://.*)?$})
+      end
+
+      def destination_path(relative_path)
+        File.join(destination_root, relative_path)
+      end
+
+      public
+
+      def install_assets
+        @missing_pins.each do |name, asset|
+          append_to_file "config/importmap.rb", "\npin #{name.inspect}, to: #{asset.inspect}\n"
+        end
+        unless @import_exists
+          if @application_exists
+            append_to_file "app/javascript/application.js", "\nimport \"active_webmcp\";\n"
+          else
+            create_file "app/javascript/application.js", "import \"active_webmcp\";\n"
+          end
+        end
+        say "ActiveWebMCP installed. Declare a GET or POST tool, then select its public name with webmcp_tools."
+      end
+    end
+  end
+end

metadata

@@ -0,0 +1,131 @@
+--- !ruby/object:Gem::Specification
+name: active_webmcp
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- zbin.song@gmail.com
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: actionpack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 8.1.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 8.1.0
+- !ruby/object:Gem::Dependency
+  name: actionview
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 8.1.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 8.1.0
+- !ruby/object:Gem::Dependency
+  name: importmap-rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
+- !ruby/object:Gem::Dependency
+  name: propshaft
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: railties
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 8.1.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 8.1.0
+description: An experimental Rails integration for explicitly selected, same-origin
+  GET and POST browser tools with normalized JSON results.
+email:
+- zbin.song@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+- SECURITY.md
+- app/assets/javascripts/active_webmcp.js
+- app/assets/javascripts/active_webmcp/runtime.js
+- lib/active_webmcp.rb
+- lib/active_webmcp/controller.rb
+- lib/active_webmcp/engine.rb
+- lib/active_webmcp/page_helper.rb
+- lib/active_webmcp/schema_compiler.rb
+- lib/active_webmcp/tool_definition.rb
+- lib/active_webmcp/version.rb
+- lib/generators/active_webmcp/install/install_generator.rb
+homepage: https://github.com/benjis/Active_WebMCP
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/benjis/Active_WebMCP
+  source_code_uri: https://github.com/benjis/Active_WebMCP/tree/v0.1.0
+  changelog_uri: https://github.com/benjis/Active_WebMCP/blob/v0.1.0/CHANGELOG.md
+  bug_tracker_uri: https://github.com/benjis/Active_WebMCP/issues
+  rubygems_mfa_required: 'true'
+  allowed_push_host: https://rubygems.org
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.3'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.16
+specification_version: 4
+summary: Explicit controller-defined WebMCP tools for Rails pages
+test_files: []