Implements WebMCP authentication for browser agents: session inheritance, cookie auth, role-gated tool registration, conditional exposure by user state. Use for auth-dependent tool management.
npx claudepluginhub orcaqubits/agentic-commerce-skills-plugins --plugin webmcp-browser-agentsThis skill is limited to using the following tools:
**Fetch live docs**:
Guides Next.js Cache Components and Partial Prerendering (PPR) with cacheComponents enabled. Implements 'use cache', cacheLife(), cacheTag(), revalidateTag(), static/dynamic optimization, and cache debugging.
Migrates code, prompts, and API calls from Claude Sonnet 4.0/4.5 or Opus 4.1 to Opus 4.5, updating model strings on Anthropic, AWS, GCP, Azure platforms.
Automates semantic versioning and release workflow for Claude Code plugins: bumps versions in package.json, marketplace.json, plugin.json; verifies builds; creates git tags, GitHub releases, changelogs.
Fetch live docs:
https://webmachinelearning.github.io/webmcp/ for authentication-related sections of the specwebmcp authentication session cookies browser agent for auth pattern guidancesite:developer.chrome.com webmcp security authentication for Chrome security modelsite:github.com mcp-b security authentication for polyfill security guidanceWebMCP's auth model is fundamentally different from backend API authentication:
This means the agent acts as the user, not as a separate entity with its own credentials.
User logs in to site (normal browser auth)
→ Page loads with authenticated session
→ JavaScript checks user auth state
→ If authenticated: register full tool set (search, cart, checkout, account)
→ If anonymous: register limited tool set (search, viewDetails only)
→ Agent discovers available tools based on current auth state
Register tools conditionally based on user permissions:
// Always register read-only tools
registerPublicTools();
// Register transactional tools only for authenticated users
if (user.isAuthenticated) {
registerCartTools();
registerAccountTools();
}
// Register admin tools only for admin users
if (user.role === "admin") {
registerAdminTools();
}
Handle login/logout during an agent session:
// On login
authService.onLogin((user) => {
registerAuthenticatedTools(user);
});
// On logout
authService.onLogout(() => {
navigator.modelContext.clearContext();
registerPublicTools(); // Re-register only anonymous tools
});
Tools must handle session expiration gracefully:
async execute(input) {
const res = await fetch("/api/cart", { credentials: "same-origin" });
if (res.status === 401) {
return {
status: "error",
code: "session_expired",
message: "Your session has expired. Please log in again."
};
}
return await res.json();
}
requestUserInteractionIf an action requires MFA (e.g., changing payment method):
async execute(input, client) {
// Check if action requires MFA
const mfaRequired = await fetch("/api/check-mfa-required");
if (mfaRequired) {
await client.requestUserInteraction((resolve) => {
// Site shows MFA challenge (OTP input, biometric prompt, etc.)
showMfaChallenge(resolve);
});
}
// Proceed with the action
// ...
}
Fetch the specification for any authentication-specific APIs, secure context requirements, and browser permission model details before implementing.