Create A WebMCP Today Package

Produce a validated webmcp-package.json in the user's workspace and prove one exact harmless read request. Stop before registry publication.

Workflow

1. Identify the target website URL and the single useful capability to expose first. Start with one read-only tool.
2. Read the current package-format reference at https://webmcp.today/docs/package-format before authoring. The skill's pinned validator is authoritative for whether the resulting package is valid.
3. Read references/api-research.md before researching an undocumented API, using browser network inspection, handling login/CSRF, or replaying a live request.
4. Prefer an official HTTP API. Otherwise observe the site's own frontend requests and document the evidence. Do not substitute DOM selectors, page scripts, or arbitrary browser automation for an API.
5. Read assets/minimal-readonly-package.json when starting a new package or when the required top-level shape is unclear. Adapt it; do not copy its example domain unchanged.
6. Create webmcp-package.json in the user's current workspace, not in this skill directory.
7. Find the directory containing this SKILL.md and treat it as SKILL_DIR. If SKILL_DIR/node_modules/@webmcp-today/schema is absent, run npm ci --prefix "$SKILL_DIR" --ignore-scripts. Never assume the user is working in a clone of WebMCP Today.
8. Validate from any directory with node "$SKILL_DIR/scripts/validate.mjs" "$PWD/webmcp-package.json". Fix every issue and rerun until it succeeds.
9. Derive the exact request from the validated endpoint and representative input, including every attached auth-source fetch. Replay only when the full request chain is harmless and reproducible by the executor. Show the method, fully resolved URL/query, credential mode, redirect behavior, and generated non-secret headers. Never execute a write for testing.
10. Show the final JSON, exact redacted request, and concise live result. State any API assumptions or untested authenticated behavior.
11. Stop. Do not submit, publish, accept registry terms, create an API key, or call a registry write endpoint. Publishing is a separate consent, legal, and write workflow.

Critical Constraints