add webmcp

README.md

@@ -125,6 +125,8 @@ it (plumcp only checks that required ones are present). A tool that touches a us
 something admin-only gets the caller from `current-user` there (`{:login :id :admin? :client-id}`),
 and must not trust anything else about who is asking.
 
+(The UI has tools of its own for a browser agent, [see below](#browser-mcp-tools-webmcp); they are not part of this server.)
+
 Sessions are kept in memory, so they end when the server restarts (clients just re-initialize; their
 tokens are in the database and keep working). Server-to-client streaming (`GET /mcp`) is deliberately
 off: nothing here pushes messages, and the response would hang under Jetty. PluMCP needs JDK 21+.
@@ -218,6 +220,37 @@ directory at `/js`, and serves `resources/public/index.html`, the shell that mou
 
 The Docker image builds the UI in its own stage, so `docker build` needs no local Node.
 
+### Browser MCP tools (WebMCP)
+
+The page also offers tools of its own to your MCP client (Claude), through [WebMCP](https://webmcp.dev):
+a small library that adds a widget to the page and lets the page register tools with it. They are the browser-side twin of the
+[server's MCP tools](#mcp-server): those work on your data on the server, these work *the page*, doing
+what you could do with the mouse and keyboard, so you see it happen. They are in `ui/src/tbd/ui/webmcp.cljs`,
+registered with `registerTool` on a `WebMCP` instance (the `@jason.today/webmcp` npm package):
+
+| Tool | What it does |
+|------|--------------|
+| `ping`, `whoami` | Health check; who is logged in on the page, if anyone |
+| `get_calculator` | What the calculator form holds: its two fields and the result it shows |
+| `add` | Types `x` and `y` into the calculator, presses Add, and returns the sum the page shows |
+| `list_todos`, `get_todo` | The todos the page shows (login required, like the todo list itself) |
+| `create_todo` | Types a `title` into the new-todo field, presses Add, returns the new todo |
+| `set_todo_done` | Ticks or unticks a todo's checkbox (`id`, `done`) |
+| `delete_todo` | Presses a todo's Delete button |
+
+Each tool dispatches the same re-frame events the views do and waits for the result to show up in
+the app-db, so what the agent sees is what the page shows, server errors included. There is no
+`update_todo` with a title as on the server, because the page can't edit one.
+
+To connect (the page's "Browser tools (WebMCP)" section says the same):
+
+1. Add the WebMCP server to your MCP client, once: `npx -y @jason.today/webmcp@latest --config claude`
+   (restart Claude Desktop afterwards).
+2. Ask the client to *make a webmcp token*.
+3. Click the blue square in the bottom right corner of the page, paste the token, and press Connect.
+   The token works once, and the page has no field for it: the widget is where it goes.
+4. The tools show up in the client, prefixed with the page's host.
+
 ## Development
 
 Every task is a bash script in `script/`. Start an nREPL server (with CIDER middleware) on the port in `.nrepl-port`, or `3000` if that
@@ -232,6 +265,7 @@ script/repl
 | Task | What it does |
 |------|--------------|
 | `script/unit-test` | Runs the Clojure tests in `test/` |
+| `script/ui-test` | Runs the ClojureScript tests in `ui/test/` under Node (needs Node and a JDK; CI doesn't run it yet) |
 | `script/integration-test` | Builds the app image, starts it on a random port, runs the [integration suite](integration-test/README.md) against it, then tears it down |
 | `script/test` | Unit tests, then integration tests (stops at the first failure) |
 | `script/docker-unit-test` | Same as `script/unit-test`, but inside the app image (Docker only) |
@@ -265,7 +299,7 @@ src/tbd/
   oauth/              tbd as the OAuth authorization server for MCP clients: rules (core), SQLite storage (db), `/oauth` + discovery routes, and the bearer-token middleware guarding `/mcp` (middleware)
   nrepl/              On-demand nREPL server (core) and the admin-only `/nrepl` routes
   todo/               Per-user todos: pure rules (core), Malli schemas of the input (schema), SQLite storage (db), `/api/todos` routes
-ui/                   ClojureScript re-frame app (shadow-cljs project); ui/src/tbd/ui/{db,events,subs,views,core}.cljs
+ui/                   ClojureScript re-frame app (shadow-cljs project); ui/src/tbd/ui/{db,events,subs,views,webmcp,core}.cljs, tests in ui/test/
 .env-template         Settings the server reads from the environment; copy to .env (git-ignored)
 resources/public/     index.html (the shell served at /) and js/ (compiled UI output, git-ignored)
 test/                 Unit tests