Docs · Start here
What the snippet loads
Every file and request the agentprose Cloud script tag makes, when it makes them, why the MCP-B WebMCP polyfill loads in some browsers, and the one domain to allow in a Content-Security-Policy.
The snippet is one script tag:
<script src="https://agentprose.cloud/v/0/agentprose.min.js" data-key="pk_…" defer></script>
Everything it loads comes from https://agentprose.cloud. No public CDN, no third-party tracker, and no cookies.
Every request, and when it happens
| What | From | When |
|---|---|---|
agentprose.min.js (the script, about 10 KB gzipped) |
https://agentprose.cloud | Page load, deferred, so it never blocks your page |
webmcp-polyfill.js (MCP-B's WebMCP polyfill, about 9 KB gzipped) |
https://agentprose.cloud | After the page has loaded, and only in browsers without WebMCP (see below) |
agentprose.index.min.js (the search engine, about 7 KB gzipped) |
https://agentprose.cloud | Only when an AI agent first calls a site-wide tool, such as searching your posts |
adapters/<cms>.min.js |
https://agentprose.cloud | Only with data-adapter (or WordPress, detected automatically), on an agent's first call |
Your notes and contact details for agents (/v1/site) |
https://agentprose.cloud | Only when an agent first asks for site or contact info on a page (agentprose 0.1.3+). See Notes and contact details for AI agents |
Hosted search (/v1/search) |
https://agentprose.cloud | When an agent searches your site |
Analytics beacon (/v1/collect) |
https://agentprose.cloud | After each tool call an agent makes: tool name, timing, page, search text. Never page content or visitor data |
| Your own pages, feeds and sitemap | Your site | When an agent asks for a post or searches without hosted search |
A visitor who is a person, not an AI agent, downloads the script and, in browsers without WebMCP, the polyfill. Nothing else.
The MCP-B polyfill: what it is and why it loads
AI agents find a page's tools through WebMCP (document.modelContext), a browser feature that most browsers don't ship yet. In those browsers, agentprose loads MCP-B's open-source WebMCP polyfill (@mcp-b/webmcp-polyfill, MIT), which supplies the standard interface. MCP-B's browser extension, its local relay for Claude Desktop and Cursor, and other WebMCP clients can then see your tools. Without it the tools still work, but no agent can discover them in those browsers.
- When: only after your page's
loadevent, so it never competes with your page; and only if the page still has no WebMCP: Chrome with native WebMCP, a page that already runs MCP-B's@mcp-b/global, or an extension that provides it all skip it. - Where from: https://agentprose.cloud, next to the script (
/v/<version>/webmcp-polyfill.js). It is the exact file published on npm, pinned to one version (6.0.3), and the script checks it with a Subresource Integrity hash. The browser runs it only if it is byte-for-byte the expected file. - Opt out: add
data-polyfill="off"to the tag. The tools stay callable from the page, but agents in browsers without WebMCP won't find them.
The polyfill loads by itself from agentprose 0.1.2. The Cloud serves agentprose 0.1.0 today.
Content-Security-Policy
One domain covers everything:
script-src https://agentprose.cloud
connect-src https://agentprose.cloud
The script needs no unsafe-eval and no unsafe-inline. If a policy blocks the polyfill anyway, the browser logs one message and agentprose carries on without it. Your page is unaffected.
Loading the open-source library from jsDelivr instead (https://cdn.jsdelivr.net/npm/agentprose@0/… with data-cloud) also loads the polyfill from jsDelivr, so https://cdn.jsdelivr.net must be in script-src too. The library's security notes cover that setup and self-hosting.
Versions and updates
/v/0/ is the evergreen channel: it serves the newest agentprose 0.x the Cloud ships and is cached for an hour, so fixes reach your site within about an hour with no change on your side. When the script comes from /v/0/, it loads its other files (engine, adapters, polyfill) from its own exact version folder, so a page never mixes two versions. Exact versions (https://agentprose.cloud/v/0.1.0/agentprose.min.js) never change and stay available, for teams that pin and use SRI. See Install the script.