anybridge MCP

One MCP server for software that has no ready-made integration.

See an interface. Turn it into a permissioned workflow. Verify the result. Replay it with no model calls.

▶ Watch the 75-second demo

Quick start · How it works · Tool catalog · Safety model · Project status · Documentation

Important

AnyBridge is an alpha prototype built during the Meta Global AI Developer Hackathon. It is not production software yet. Known security and correctness gaps are listed in Project status and tracked in docs/REVIEW-2026-11-01.md.

AnyBridge connects an MCP-capable assistant to software you already have: a CLI tool, a local web app, or files on disk. Instead of asking the model to invent shell commands, selectors, or code, it exposes the interface as a numbered menu. The model chooses IDs from that menu, proposes a typed JSON workflow, and stops. A local engine performs the checks and runs the steps.

The goal is compile once, replay forever: the model explores and compiles the workflow once; subsequent runs execute the saved workflow deterministically, with no model calls inside the server and no API key required for replay.

Why AnyBridge

Browser-control MCP servers expose actions. AnyBridge adds the pieces needed to trust an action later:

Concern	AnyBridge approach
The model invents commands or selectors	Discovery returns a numbered menu; plans reference menu IDs
Capability is mistaken for permission	Discovery is read-only; execution is a separate, policy-gated phase
The model declares success	Verification is evidence-based and engine-computed
Every run pays for exploration	Verified plans are saved as typed workflows and replayed without the model
A plan changes after approval	Plans are intended to be hash-bound and versioned
Observed text contains instructions	Pages, files, and command output are treated as untrusted data

Model-agnostic by design

AnyBridge does not call an LLM. It is a local MCP server that any assistant can drive: Claude, Codex, Gemini, OpenCode, or another MCP client. Bring your own model, or bring none for replay.

For this hackathon build, development and reported evaluation results use Muse Spark 1.3 Contributor (muse-spark-1.3-contributor). The canonical route is Meta Model API; when no MODEL_API_KEY is available, the same model through the OpenCode Go gateway is used and labelled as a fallback. Contributor mode may use prompts for training, so this project uses synthetic fixtures only. The product itself remains provider-neutral.

Quick start

Requires Node.js 20+ and npm.

git clone https://github.com/ps-aditya/anybridge.git
cd anybridge
npm install
npx playwright install chromium
npm run build
npm test
npm run doctor

The fixture app runs in a separate terminal:

npm run fixture:reset

It serves http://127.0.0.1:4010/tasks; its state is fixtures/app-a/data.json.

The server speaks MCP over stdio:

node dist/index.js

Register that command with your MCP client. Minimal OpenCode example:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "servers": {
      "anybridge": {
        "type": "local",
        "command": ["node", "/absolute/path/to/anybridge/dist/index.js"]
      }
    }
  }
}

Then ask your assistant:

Use AnyBridge to discover the allowed CLI tools, inspect the `node` interface,
and propose a read-only workflow that reports its version. Do not execute it
without my explicit approval.

How it works

1. Discover. discover_capabilities lists allowlisted CLI tools, browser origins, and saved workflows.
2. Inspect. inspect_interface turns CLI help or an ARIA page snapshot into a numbered menu (a1, a2, …) with inputs and an effect label.
3. Propose. The model picks menu IDs and submits a typed workflow with steps and independent checks. It never writes code, selectors, or URLs.
4. Approve. A human runs anybridge approve <plan_id> in a separate terminal. The model cannot create the approval. Approvals are single-use, hash-bound, and expire after 10 minutes.
5. Execute. The engine resolves each step, re-checks policy, and runs it with argv arrays and bounded output. Destructive actions are denied by default.
6. Verify. verify_outcome returns pass, fail, or inconclusive with evidence. Only this result counts as success.
7. Save and replay. A verified workflow is stored and can be run with run_saved_workflow; replay makes no model calls.

What you can automate

Adapter	Discovery	Execution	Intended verification
CLI	Allowlisted tool help → commands and flags	execFile with argv arrays, no shell, timeout and output caps	Exit codes, filesystem state
Browser	Playwright ARIA snapshot → role/name menu	Local Chromium: navigate, click, fill, select, wait, read text	DOM text and page state
Filesystem	Not an adapter; a verification substrate	Read, exists, SHA-256 hash inside a path jail	File content, existence, hashes

The current scope is CLI and browser. Desktop automation, remote hosting, generated code, and model calls inside the server are explicitly out of v0.

Tool catalog

Tool	Purpose	Risk
discover_capabilities	List reachable CLI tools, origins, saved workflows	Read-only
inspect_interface	Open one target and return a numbered capability menu	Read-only
propose_workflow	Validate a plan and return plan_id + hash	No execution
execute_workflow	Run a human-approved plan	Destructive
verify_outcome	Run independent checks and return evidence	Read-only
save_workflow	Store a verified plan for replay	Low
run_saved_workflow	Replay a saved workflow with parameters	Destructive

Safety model

AnyBridge is deny by default. The design contract is:

• CLI execution uses an explicit allowlist and argv arrays; never a shell string.
• Browser requests use an origin allowlist on every request.
• Filesystem access is confined to a configured path jail with realpath checks.
• The model supplies menu IDs and arguments, not code or selectors.
• Approval is out-of-band, single-use, hash-bound, and expiring.
• Policy is checked again on the resolved step at execution time.
• Observed content is untrusted data, never instructions.
• Success comes only from engine-computed evidence.
• Saved workflows are hash-pinned; edits create new versions.

This alpha does not yet satisfy every line above. Treat it as a prototype, not a security boundary. The concrete gaps, evidence, and failing-test sketches are in docs/REVIEW-2026-11-01.md, and vulnerability reporting is described in SECURITY.md.

Project status

Working today

• Seven MCP tools over stdio, with Zod input schemas and structured errors.
• CLI discovery from help output and browser discovery from ARIA snapshots.
• CLI/browser/filesystem step execution and a JSON workflow store.
• Out-of-band approval CLI (anybridge approve <plan_id>): single-use, hash-bound, 10-minute expiry; execution refuses without it.
• Browser origin enforcement on every request, including link clicks and redirects, plus allowlist checks during inspection.
• Independent file_contains verification that reads the target file at verification time.
• Hash-pinned, versioned saved workflows; tampering and path-traversal names are rejected.
• Replay runs the saved checks and fails on drift.
• Realpath path-jail check blocks junction/symlink escapes.
• Red-team gate: 8/8 covered cases blocked; 46/46 tests pass.
• Fixture app A (fixtures/app-a) with JSON state and a hostile Notes page.
• Eight measured tasks: 8/8 plan → execute → verify → replay (results/eight-task-results.md).
• Save and replay path with no model calls inside the server.
• 46 unit tests; npm run lint, npm run build, and npm test pass.

Release blockers

• Demo video rendered (dist/anybridge-demo.mp4, ~75 s, 1920×1080; see docs/VIDEO.md).
• Eight measured tasks: 8/8 pass (results/eight-task-results.md).
• Broaden red-team coverage (DOM checks, file_hash_changed, npm scripts).
• Policy re-checks on all resolved step types at execution and replay.
• Direct Meta Model API E0/eval run when MODEL_API_KEY is available.
• Submission form and YouTube upload.

Not in v0

Desktop automation, a marketplace, remote hosting, generated code, and model calls inside the server.

Built during the event

AnyBridge is being built during the Meta Global AI Developer Hackathon (Oct 26 – Nov 4, 2026). Development, E0, and all reported evaluation numbers use Muse Spark 1.3 Contributor: Meta Model API when a key is available, otherwise the OpenCode Go gateway, labelled as a fallback. The demo and measurements are being produced during the event window; no pre-event work is presented as new.

Documentation

• Project brief — product, scope, safety rules, metrics.
• E0 protocol — Meta runtime gate and trial record.
• Architecture review — findings and failing-test sketches.
• Red-team gate — covered cases, results, and limits.
• Measured tasks — eight tasks and results.
• Demo video pipeline — automated Remotion + Kokoro build.
• Master prompt — video agent instructions and provenance.
• Submission pack — upload copy, form draft, and pre-submit checks.
• Hackathon facts — source-checked rules and open questions.
• Security policy — private reporting and testing rules.
• License — MIT.

Contributing

This is a hackathon-stage project. Open an issue with the target, the task, and the evidence you expected; use synthetic fixtures and never include real accounts, secrets, or personal data. Security issues should follow SECURITY.md, not the public issue tracker.

License

MIT © 2026 ps-aditya.