MCP roadmap

[kof]

Problem

Webstudio MCP now has a stable semantic runtime, compact discovery, direct CLI
tool calls, guarded mutations, rendered verification, and privacy-safe local
evaluation regression gates. The remaining work is spread across Craft-aware
authoring, broader workflow evidence, long-session reliability, optional live
Builder context, onboarding, and experimental authoring surfaces.

Without one product-level backlog, these initiatives can drift into isolated
tool additions without evidence that they improve task completion or preserve
Webstudio's safety and compatibility guarantees.

Desired outcome

Make minimally prompted agents reliably inspect, author, verify, and recover in
real Webstudio projects while keeping project semantics in the shared runtime,
measuring improvements against reproducible fixtures, and avoiding collection
of project content or credentials.

Product scope

Craft-aware authoring

• Return a focused Craft guide for the current task with the detected
  profile and exact existing token and variable names.
• Document distinct workflows for adopting Craft, extending an existing
  Craft project, and working in a non-Craft project.
• Define the Craft Core and Craft Library boundary, including profile
  version, provenance, dependencies, variants, responsive evidence, and
  compatibility metadata.
• Add a non-mutating template compatibility preflight that reports missing
  prerequisites, conflicts, unsupported variants, and proposed changes.
• Ship verified Craft templates for Navigation Menu, mobile Sheet,
  Dialog/Popup, Tabs, and one carousel using Craft variables rather than
  disconnected visual values.
• Verify template insertion, keyboard behavior, focus, close/Escape,
  responsive behavior, failure states, editability, and preservation of
  deliberate local changes.
• Defer bootstrap and repair until inspection, guidance, and official
  template insertion work end to end. Then provide an explicit dry-run and
  user-approved apply flow that preserves modified project values by
  default.
• Add version-aware Craft audit CLI shorthand, lifecycle rules, generated
  documentation, and end-to-end clean/extend/bootstrap/repair fixtures.

Representative workflow evidence

• Expand the versioned benchmark to cover editing an existing section,
  responsive repair, external data, multi-page content/SEO work, and
  preview-to-publish in addition to the existing auth, design, font, and
  Assets workflows.
• Add failure fixtures for ambiguous targets, stale versions, partial
  prerequisites, permission changes, conflicting edits, interrupted
  mutations, and unavailable preview/browser dependencies.
• Run comparable fixtures across supported clients and a small set of
  current model families.
• Compare the current flat tool surface with focused discovery,
  domain-layered tools, and selective advertisement. Adopt a different
  surface only when completion, error, call, latency, and context results
  justify its compatibility cost.
• Continue deriving composite or intent-level operations only from measured
  repeated orchestration. Require stable semantics, dry-run evidence,
  preconditions, deterministic tests, and durable commit evidence.
• Audit actionable errors across the benchmark so each includes a stable
  code, failed path or precondition, retry safety, possible state change,
  and the smallest corrective action.

Stateful runtime reliability

• Add long-session and failure-injection coverage for stale namespaces,
  compatibility changes, concurrent CLI processes, multi-client conflicts,
  termination during dispatch, restart/resume, cancellation, and cleanup
  of preview and screenshot resources.
• Verify that every mutation distinguishes computed, dispatched, durably
  committed, conflicted, and ambiguous outcomes.
• Measure repeated stable-context reads and evaluate a bounded session
  summary keyed by build version and invalidated by namespace changes.
• Inventory operations that still require Builder UI state and implement
  headless semantic support where practical.

Optional live Builder bridge

• Define a versioned, targeted collaboration message contract for bounded
  current project, page, selection, and viewport context plus ephemeral
  navigation, selection, reveal, and focus actions.
• Add server-authorized pairing between one authenticated CLI client and
  one visibly consenting Builder tab without exposing credentials or
  bridge traffic to other room participants.
• Route project mutations through the normal collaboration transaction,
  conflict, broadcast, and durable-acknowledgement path.
• Cover rejection, expiry, revocation, reconnect, multi-tab behavior,
  dropped messages, permission changes, and conflicts with real
  multi-client integration tests.

Privacy-safe onboarding and reliability feedback

• Decide which onboarding and reliability questions require product
  telemetry before collecting events.
• Define destination, owner, consent, retention, deletion, access control,
  and observable delivery failure.
• Limit any event contract to coarse, versioned milestones and reject
  project identifiers, content, commands, arguments, URLs, credentials,
  transcripts, and free-form errors.
• Establish a review loop that turns repeated bounded signals into sanitized
  fixtures and verifies improvements before rollout.
• Treat a workflow as successful only when its requested persisted or
  rendered outcome is verified, not merely when calls return successfully.

Setup and reusable guidance

• Measure time to first successful read and mutation for Claude Code,
  Codex, Cursor, and VS Code, classified by installation, authentication,
  linking, configuration, restart/discovery, permissions, and tool
  selection.
• Add client-specific connection smoke tests and recovery diagnostics that
  preserve unrelated configuration and never expose credentials.
• Package versioned focused skills or generated guides for workflows proven
  by fixtures, such as responsive repair, external data, SEO,
  accessibility, and Craft-aware authoring.
• Evaluate each skill with and without the skill on the same fixtures.
• Investigate a hosted connector only if measurements show local setup is a
  material adoption barrier and authentication, scoping, isolation,
  revocation, data handling, cost, and feature parity are defined first.

Experimental authoring surfaces

• Prototype one narrow, lossless human/agent-editable filesystem round trip
  through the existing parser, semantic validation, dry-run, conflict, and
  atomic patch pipeline. Do not treat .webstudio/data.json or generated
  application files as editable contracts.
• Compare that prototype with semantic MCP tools on the same workflow
  benchmark before adopting, narrowing, or rejecting it.
• Treat a published shadcn-compatible registry and conversion adapters as
  conditional work. Preserve upstream provenance, dependencies, conversion
  status, and compatibility evidence if pursued.

Constraints

• Keep project semantics and semantic validation in packages/project-build or
  the existing owning domain/build/upload service.
• Keep Builder patches limited to synchronized, versioned project state. Use
  dedicated server APIs for identity, permissions, plans, publishing, domains,
  and binary transfer.
• Do not weaken authorization, destructive confirmation, MCP annotations,
  operation schemas, collaboration durability, or compatibility aliases when
  adding a new surface.
• Generate discovery, guides, manuals, and public schemas from owning catalogs
  so examples and operation references cannot drift.
• Keep non-Craft projects unchanged unless the user explicitly adopts Craft.
• Never persist pairing credentials, project content, private URLs, prompts,
  transcripts, or tool arguments in telemetry or generated artifacts.

Acceptance criteria

• A minimally prompted agent uses real project context and completes the
  representative workflows without inventing ids, tokens, variables, or design
  conventions.
• Persisted and rendered outcomes, errors, retries, calls, latency, and bounded
  context cost are comparable by CLI version, client, model family, and fixture
  version.
• New intent operations and tool-surface changes are backed by a reproducible
  failure or measured efficiency problem and outperform the compatible
  baseline.
• Long-running and concurrent sessions cannot report ambiguous transport
  success as a durable mutation.
• Optional live Builder access is explicit, targeted, revocable, and isolated
  from unrelated collaborators.
• MCP setup and usage continue to work when telemetry is disabled or
  unavailable, and automated tests reject sensitive event fields.

Unresolved product questions

• Which Craft profile and official template source should be canonical?
• Is live Builder context valuable enough to justify the bridge and consent
  surface after headless gaps are inventoried?
• Which product questions, if any, justify onboarding telemetry?
• Do benchmark results support domain tools, selective advertisement, a file
  representation, or a hosted connector strongly enough to absorb their
  compatibility and maintenance costs?