Overview
Mulder turns selected OpenAPI 3.1 operations into WebMCP tools. It generates descriptors and request construction; in server-backed mode your application continues to own identity, policy, approval, execution, and result filtering.
What Mulder does
- Generates deterministic tool names and input schemas.
- Rejects enabled operations it cannot preserve safely.
- Publishes same-origin discovery and call routes in the complete companion.
- Separates direct reads from approval-managed writes.
What stays in your app
- Authentication and authorization.
- Write approval and idempotency.
- API credentials and cookies.
- Business logic and response filtering.
Where it fits
Browser agent
-> Mulder tool route
-> validated input
-> your policy and APITool annotations describe risk. They do not grant authority.