Why I was looking for more than model updates

When I watched Google I/O 2026, I was not only paying attention to the new model announcements. What I cared about more was whether Google was making its AI ecosystem feel easier to build with in a practical way.

That probably comes from my own experience using Google AI Studio, Gemini models, and local Gemma workflows in small projects. After spending time with those tools, it becomes harder to look at a keynote as a list of separate upgrades. What stands out more is whether the path from idea to usable product is becoming clearer.

That was the part I hoped to see this year.

What stayed with me from this year’s I/O

The main thing I noticed was that Google seemed to be telling a more connected story.

AI Studio no longer felt like it was only about testing prompts. Antigravity did not feel like a side experiment. The announcements around models, agents, app building, and deployment all seemed to move in the same direction.

That mattered to me because the difficult part of building with AI is rarely just getting one good output. More often, the real friction comes later: choosing the right tool, turning the result into something usable, connecting it to the rest of the app, and dealing with everything that happens after the prototype stage.

That is why the workflow stayed with me more than the model list itself.

Why lightweight models still matter to me

One reason I see it this way is because of my own experience with Gemma.

What I appreciated about local Gemma workflows was not that they tried to do everything, but that they felt light enough to experiment with and practical enough for focused tasks. For developers who are still learning how to bring AI into real projects, that kind of accessibility matters a lot.

A model does not always need to be the most advanced option to be useful. Sometimes what matters more is whether it is affordable, lightweight, and easy enough to try without turning the whole project into a heavy setup problem.

That is why lightweight models still matter to me, even in a keynote full of bigger announcements.

What I was hoping to feel more clearly from Gemini

With Gemini, my expectation was a little different.

I have already found Gemini useful for prototyping and for turning ideas into something testable more quickly. What I hoped to feel more clearly this year was not only stronger capability, but clearer model roles.

Once you start building actual features, it matters whether a model feels better suited for fast iteration, structured reasoning, creative generation, or more agent-style tasks. When those differences feel clearer, the ecosystem also starts to feel more mature.

That is one of the things I still look for beyond the announcements themselves: not only more capability, but more clarity.

Where I still notice the gap between speed and polish

I felt something similar when using Google AI Studio for visual generation.

What I liked was the speed. It was genuinely helpful for turning an idea into something visible, especially in the early stage of a project. At the same time, the results often felt closer to a strong draft than to something fully refined. They were useful for ideation, but not always polished enough to stand on their own.

That did not make the experience less useful. It just made me care more about refinement.

If Google is moving toward a workflow where ideas can move more quickly from prompt to product, then polish starts to matter alongside speed.

Why Antigravity stood out to me

This is also why Antigravity felt important in this year’s I/O story.

What interested me was not simply that agent-based tooling can do more, but that Google seems to be pushing it toward a more realistic place in the development workflow. Earlier tools already showed convenience, but they also left behind a familiar amount of cleanup: fixing structure, checking code quality, and adjusting the details that still needed human judgment.

Because of that, I found myself looking at Antigravity less as a flashy feature and more as a sign of where Google wants the developer experience to go.

The version of agent-based development that feels meaningful to me is not “AI does everything.” It is the idea that better tooling reduces low-value friction and leaves developers with more time for architecture, design decisions, and quality.

Why the story felt broader this year

One thing I liked about this year’s I/O was that this shift did not stay only inside developer tools.

Gemini Spark made the agent story feel more complete to me, because it suggested a more persistent kind of assistant experience. It felt less like asking for a single reply and more like giving a system a goal and letting it continue the work.

The same thing appeared in the search and commerce direction. Once agents start moving into search, shopping, and more action-oriented tasks, the conversation changes. At that point, it is not only about capability anymore. It becomes about trust, clarity, and whether the workflow feels understandable enough for people to actually rely on it.

Even Flutter made the picture feel a little broader to me, because it suggested that this shift is not staying limited to AI-native tools. It is starting to touch more mainstream development workflows too.

What I was really hoping to see

When I step back from all of this, I think what I was really hoping to see at Google I/O 2026 was a clearer sign that Google’s ecosystem is becoming easier to build with in practice.

For me, that means things like:

• clearer model roles
• smoother movement from prototype to product
• less cleanup after generation
• more usable agent workflows
• and tools that feel more helpful for developers at different stages

Those are not always the flashiest parts of a keynote, but they are often the parts that decide whether people keep building after the excitement fades.

Final takeaway

What I took away from Google I/O 2026 was not that the model announcements were unimportant. They were clearly a big part of the event.

What stayed with me more, though, was the sense that Google is trying to make the space around those models feel more complete. After already using tools like Google AI Studio, Gemini, and Gemma in small projects, that was the part I found easiest to connect with.

This year’s announcements made me think less about how many new model options there are, and more about whether the overall workflow is becoming easier to build on.

That was what I hoped to see beyond the model announcements, and it was the part of Google I/O 2026 that felt most meaningful to me.

If your “AI agent” follows the same path every single time, I have news for you. That’s a script.

The term “agent” has become the new “cloud.” Slap it on anything and watch the funding roll in.

Why This Matters Right Now

Developers are in a heated battle over the very definition of “agent”. It’s a noisy, messy, and ubiquitous debate occurring in every programming community I pay attention to.

And honestly? The confusion is the product. Startups love that nobody agrees on a definition because it lets them call everything an agent.

The Three Things People Keep Conflating

Here’s the rough taxonomy I keep seeing developers converge on:

→ Tool-using chatbots — An LLM that can call an API when you ask it to. It’s a chatbot with hands. Not an agent.

→ Prompt-driven workflows — A hardcoded sequence of steps where an LLM handles some text processing in the middle. It’s a pipeline. Still not an agent.

→ Autonomous decision loops — A system that observes its environment, decides what to do next without a predetermined path, and adjusts based on outcomes. This is the only one that earns the word “agent.”

Most of the products I have reviewed are solidly in bucket one or two, but they position themselves as bucket three.

The “If” Statement Test

Here’s my quick gut check. Look at the code (or the architecture diagram, if that’s all you can get).

If you can easily describe what the system does using a simple flowchart that fits on a napkin, then it’s orchestration. If you could rip out the LLM, replace it with a regex or a template, and describe the majority of the behavior in the same way, then it’s a script with an overcomplicated language model tacked on.

An actual agent surprises you. Not because it’s buggy — because it chose a path you didn’t explicitly wire up. That’s the difference. Deterministic control flow with an LLM in the middle is not agency. It’s automation with better vibes.

Why Label Inflation Hurts Us 🔥

This is more than just arguing about words. It’s actively making tool evaluation harder for working engineers.

When every product out there is an “agent” you cannot filter. You spend hours in demos only to discover the thing is a glorified cron job agent calling GPT-4 in a loop. Devs are getting more vocal about this, and the pushback against generic agent marketing is real.

This type of discussion also has a negative impact on discussions regarding truly agentic systems. Important issues such as goal decomposition, error recovery, and safe autonomy are overlooked because they are overshadowed by the marketing hype of products that are not exposed to such challenges since they never actually allow the model to decide.

The Uncomfortable Truth

Ironically, some of those scripts that are perceived as “mere scripts” are actually quite handy: a well-designed prompt-driven script can be more robust, more maintainable, and less expensive to operate than a fully autonomous agent.

The problem isn’t building pipelines. Pipelines are great. The problem is calling your pipeline an agent so you can charge agent prices and ride the hype wave 🏄.

If the industry settled on honest labels, we’d all evaluate tools faster, set better expectations, and stop being disappointed when our “agent” can’t handle a task that wasn’t in its flowchart.

Where I Land

Refer to your scripts as scripts and your pipelines as pipelines. Reserve the term “agent” for systems that truly operate autonomously in unbounded environments. The threshold should be very high as the term implies a level of capability that most systems do not possess.

Honest naming isn’t just good engineering culture — it’s how we keep our tools trustworthy and our hype cycles from eating us alive. 💀

So here’s my question: what’s the most egregious example of “agent-washing” you’ve seen in the wild?

🚀 Replicating the evasive VoidLink: My Journey Building Cortex C2

One of the biggest inspirations behind Cortex C2 is the sophisticated design of VoidLink — the advanced, cloud-native Linux malware framework that surfaced in late 2025 / early 2026. While VoidLink represents high-end, production-grade offensive tooling (with heavy AI assistance in its development), my goal with Cortex C2 is to create an open, educational, and accessible counterpart that captures many of its architectural strengths without the malicious intent. 🛡️

What Impressed Me About VoidLink 🤔

From public analyses, VoidLink stands out for several reasons:
• 🧩 Modular plugin architecture — Dynamically loadable modules for reconnaissance, credential harvesting, lateral movement, and more (over 30 plugins reported).
• 🕵️ Advanced stealth — Hybrid rootkit techniques including Loadable Kernel Modules (LKMs), eBPF, and userland methods like LD_PRELOAD.
• ⚙️ On-demand capabilities — The C2 can compile kernel modules tailored to the victim’s exact kernel version (Serverside Rootkit Compilation).
• ☁️ Cloud & container awareness — Deep fingerprinting of AWS, GCP, Azure, Kubernetes environments, with container escape and privilege escalation paths.
• 🌐 Multiple C2 channels — HTTP/HTTPS, ICMP covert channels, DNS tunneling, and even P2P/mesh communication between agents.
• 🦾 Modern development — Built with languages like Zig, extensive use of AI/LLMs for rapid iteration, and a polished web dashboard.

It’s a clear demonstration of how quickly the offensive security landscape (and unfortunately, the threat landscape) is evolving toward Linux and cloud targets. 🎯

How Cortex C2 Aims to Replicate (and Learn From) VoidLink 🧠

Cortex C2 is my attempt to distill these ideas into a transparent, community-driven project focused on security research and education. Here’s where the inspiration directly shaped the design:

• 🧱 Modularity First — Just like VoidLink’s plugin ecosystem, Cortex supports on-demand plugin downloads. Agents can dynamically fetch and execute additional binaries or scripts. The agent/orchestration/ folder (Python-based) makes it easy to extend behaviors — for example, adding new exfiltration methods or Telegram-based C2 channels.
• 🐧 Linux-First Design with Embedded Focus — Tested successfully on ARM Cortex-A53 devices, Cortex targets the same Linux environments (including IoT and embedded systems) that VoidLink excels in. While not as advanced yet, the architecture is built to support future kernel-level components.
• 🔌 Custom Protocol & Extensibility — Instead of hard-coded implants, Cortex uses a custom JSON-based database and application-layer protocol. This mirrors the flexible, extensible nature of VoidLink while remaining fully auditable and modifiable by researchers.
• 🔓 Lateral Movement & Privilege Escalation — Built-in SSH brute-forcing and integration with a known privilege escalation CVE (2026-43284) echo VoidLink’s emphasis on practical post-exploitation chains.
• 🖥️ Team Server + Web Interface — A Flask backend with HTML/JS client provides operator control similar to VoidLink’s dashboard — agents list, command issuance, task history, and more.
• 🔮 Future-Proofing for Stealth & Cloud Features — The roadmap includes container-aware plugins, better evasion techniques, and on-demand compilation ideas inspired by VoidLink’s Serverside Rootkit Compilation. I’m also exploring hybrid userland/kernel approaches.

Key Differences (Transparency & Ethics) ⚖️

• 🎯 Purpose: Cortex C2 is strictly for authorized red teaming, CTFs, academic research, and defensive tool-building. It is not production malware.
• 📚 Stealth Level: Currently more educational/proof-of-concept than fully evasive. No advanced rootkits or covert channels yet — these are areas I plan to research responsibly.
• 🔓 Open Source: Everything is public on GitHub so defenders can study it and improve detection, while attackers-turned-researchers can learn modern C2 design.
• 🤝 Development Approach: While VoidLink leveraged heavy AI assistance for rapid development, Cortex combines manual low-level C coding with Python orchestration and community input.

I openly credit VoidLink’s public technical breakdowns as a north star for features I want to implement safely and ethically. 🌟

Call to the Community 📣

If you’re interested in Linux post-exploitation, kernel development, or building better defensive tools, Cortex C2 is a great sandbox to experiment in. Contributions toward:
• 🔌 Additional plugins (especially cloud/container focused)
• 🛡️ Improved persistence and evasion (within legal bounds)
• 🎨 Better web UI/UX
• 📄 Documentation and example scenarios
…are all welcome. 🙌

VoidLink showed what a single motivated developer (with AI help) can achieve in a short time. Cortex C2 is my open invitation to do the same — but together, and for the good of the cybersecurity community. 💪

Repository:
https://github.com/josephrw12/cortex-c2 🔗

Tags: #VoidLink #C2Framework #LinuxOffense #RedTeam #OffensiveSecurity #OpenSourceSecurity

new stuff dropped in duckkit 🦆

typed event emitter. function composition. partial application.

here’s what it looks like.

before

emitter.on('win', (amount) => {
  // amount is any 😬
})

emitter.emit('win', 'oops')  // no error
emitter.emit('wiiin', 500)   // typo. also no error.

after

const emitter = createEmitter<{
  win: number
  spin: void
  error: { code: number; message: string }
}>()

emitter.emit('win', 500)       // ✅
emitter.emit('win', 'oops')    // ❌ TypeScript error
emitter.emit('wiiin', 500)     // ❌ TypeScript error
emitter.emit('win')            // ❌ payload missing

define the map once. TypeScript does the rest.

pipeline — reusable composed functions

const process = pipeline(
  (s: string) => s.trim(),
  s => s.toUpperCase(),
  s => s.split(' '),
)

process('  hello world  ')  // ["HELLO", "WORLD"]
process('  foo bar  ')      // ["FOO", "BAR"]

async steps work too — mix sync and async freely.

curry

const multiply = curry((factor: number, value: number) => value * factor)

[1, 2, 3].map(multiply(2))   // [2, 4, 6]
[1, 2, 3].map(multiply(10))  // [10, 20, 30]

npm install duckkit

npm · GitHub

do you use typed emitters? or just wing it with strings? 👇

We had spent over a year building “Echo,” a decentralized digital product that allowed creators to sell their exclusive content directly to fans using blockchain-based tokens. Our vision was to liberate creators from the constraints of traditional payment platforms and enable them to monetize their work without the need for intermediaries.

The Problem We Were Actually Solving
When we launched Echo, we were excited to see creators from all over the world join our platform. However, it didn’t take long to realize that our biggest challenge lay not with our technology, but with the financial system. In my home country, crypto transactions are subject to strict regulations, making it nearly impossible for creators to receive payments. We quickly discovered that many of our users were facing similar issues, and we realized that we had to find a way to make our product accessible to creators in restricted countries.

What We Tried First (And Why It Failed)
Initially, we thought that implementing a strict Know-Your-Customer (KYC) and Anti-Money Laundering (AML) policy would be enough to get our platform compliant with the regulations in my home country. We worked with a reputable third-party vendor to integrate their compliance software into our platform, but it turned out to be a costly and bureaucratic nightmare. The delays in implementing the software, coupled with the high fees associated with it, made our platform uncompetitive, and our creators began to leave in droves.

The Architecture Decision
After much deliberation, we decided to pivot our approach and adopt a decentralized finance (DeFi) strategy. We created a separate blockchain-based wallet that allowed our creators to receive payments directly from their fans, without being tied to any specific country or banking system. This move not only made our platform more accessible to restricted countries but also reduced our transaction fees significantly. We also implemented a tiered pricing system, which allowed creators to earn more for their most valuable content.

What The Numbers Said After
The DeFi pivot was a game-changer for our platform. Within six months, we saw a 300% increase in creator sign-ups from restricted countries, and our revenue grew by 50%. Our adoption of a tiered pricing system also led to a 25% increase in revenue per creator. The numbers clearly showed that our decision to adopt a DeFi strategy was the right one, but we still had many challenges ahead.

What I Would Do Differently
In retrospect, I would have explored DeFi options earlier in the game. Our delay in adopting this strategy cost us time and revenue, but it also gave us a chance to refine our approach. I would also have worked more closely with our creators to understand the specific challenges they faced in restricted countries and designed our platform accordingly. This understanding would have allowed us to create a more targeted solution that addressed the needs of our users.

The Problem We Were Actually Solving

Our users weren’t just any users. They were digital creatives – artists, writers, musicians, and designers – who desperately needed to monetize their work. By building a crypto-payment gateway that bypassed traditional payment processors, we aimed to create an inclusive platform where creators from all over the world could sell their talents without geographical restrictions. It was a matter of economic equity.

What We Tried First (And Why It Failed)

Initially, we attempted to use the popular crypto-payment library, CoinPayments, to integrate crypto payments into our platform. However, this approach failed miserably. The CoinPayments API proved unresponsive, with an average latency of 2.5 seconds, which was far beyond our acceptable threshold of 500 milliseconds. Moreover, the API’s cost per transaction was exorbitant, with a query cost of $0.05. Our target was to keep the query cost below $0.005. This was unacceptable.

The Architecture Decision

We took a hard look at our architecture and decided to switch to a custom-built solution using the MetaMask library. By leveraging Ethereum’s scalable network and developing a bespoke API, we managed to reduce latency to an astonishing 150 milliseconds. Not only was MetaMask cheaper, with a query cost of $0.002, but it also provided the flexibility to customize our payment flow according to our specific needs. This was a game-changer.

What The Numbers Said After

The impact was immediate. Our platform saw a 25% increase in creator adoption, with a corresponding 30% increase in transactions. More importantly, our creators were now able to access the global market, earning more than they ever had before. The success was a testament to the power of a tailored solution, one that prioritized performance, cost-effectiveness, and flexibility.

What I Would Do Differently

If I were to redo the project, I would focus even more on the trade-offs between scalability and cost. While our custom-built solution performed admirably, it required significant maintenance and updates to ensure compatibility with the ever-evolving Ethereum network. In hindsight, I would have invested more time in exploring cost-effectiveness without compromising scalability. Nevertheless, the experience taught me the importance of making deliberate trade-offs in system design, acknowledging that no solution is perfect, and that sometimes, the best choice is the one that balances competing priorities.

Episode 2 of Verified or Not — testing Debuggix against known repositories.

Last week: OWASP Juice Shop — 0 issues.
This week: Snyk’s nodejs-goof — the deliberately vulnerable app Snyk uses to demo their own scanner.

🔍 THE SCAN
• 9 engines: Semgrep, Bandit, Gitleaks, TruffleHog, Trivy, ESLint, Hadolint, Checkov, OSV-Scanner
• 213 findings. 33 critical. 91 high.
• All 9 engines running in parallel

📊 THE RESULTS
• Needs Attention: 0
• Reviewed: 213
• Every finding marked intentional

🤖 WHY ZERO?
Debuggix detected this is a known vulnerable test repo. It read the README. It knew this app was built to be hacked. A dumb scanner would dump 213 findings. Debuggix understood context.

📅 THE SERIES
Episodes 1–6: Testing against known-vulnerable repos to prove Debuggix works.
Episode 7+: Scanning trending repos. Verified or Not?

🔗 Scan your repo free: Debuggix

Your AI agent can analyze markets, generate trading strategies, and even write smart contracts. But can it actually execute those trades? Most AI frameworks hit a wall when it comes to blockchain interactions—until now.

Why AI Agents Need Wallet Infrastructure

AI agents are getting incredibly sophisticated. They can research DeFi protocols, identify arbitrage opportunities, and build complex trading strategies. But there’s always been a gap: the moment they need to actually interact with money, they’re stuck.

Traditional solutions require agents to manage private keys directly (dangerous), rely on external wallet APIs (centralized), or ask humans to manually execute every transaction (defeats the purpose). What’s needed is a secure, self-hosted wallet service that agents can integrate with—regardless of which AI framework you’re using.

OpenClaw: 17 Tools for Any AI Framework

WAIaaS solves this with OpenClaw, a plugin that provides 17 sessionAuth tools specifically designed for AI agent integration. While WAIaaS has native MCP integration with 45 tools for Claude, OpenClaw brings the core wallet functionality to any AI framework—LangChain, CrewAI, AutoGPT, or custom agent implementations.

Here are the 17 OpenClaw tools available for your agents:

Wallet Management Tools

• get-balance — Check wallet’s native token balance
• get-address — Get wallet’s public address
• get-assets — List all token balances
• get-wallet-info — Complete wallet information

Transfer Operations

• send-token — Send native tokens or SPL/ERC-20 transfers
• transfer-nft — Send NFTs (ERC-721/ERC-1155 on EVM, Metaplex on Solana)
• approve-token — Approve token spending for DeFi protocols

DeFi Integration

• get-defi-positions — View lending positions, staking rewards, liquidity pools
• execute-action — Execute DeFi operations across 15 integrated protocols
• get-health-factor — Monitor lending health across Aave, Compound, etc.

Transaction Management

• sign-transaction — Sign arbitrary blockchain transactions
• simulate-transaction — Dry-run transactions before execution
• get-transaction — Query transaction status and details
• list-transactions — Get transaction history

Advanced Features

• x402-fetch — HTTP requests with automatic micropayments
• sign-message — Sign arbitrary messages for authentication
• get-policies — Check active spending limits and restrictions

Quick Integration Example

Here’s how to integrate OpenClaw tools with a Python AI agent:

import requests
from typing import Dict, Any

class WAIaaSTools:
    def __init__(self, base_url: str, session_token: str):
        self.base_url = base_url
        self.headers = {"Authorization": f"Bearer {session_token}"}

    def get_balance(self) -> Dict[str, Any]:
        """Get wallet balance - core tool for any trading agent"""
        response = requests.get(f"{self.base_url}/v1/wallet/balance", headers=self.headers)
        return response.json()

    def send_token(self, to: str, amount: str, token: str = None) -> Dict[str, Any]:
        """Send tokens - essential for executing trades"""
        payload = {"type": "TRANSFER", "to": to, "amount": amount}
        if token:
            payload["type"] = "TOKEN_TRANSFER"
            payload["token"] = token

        response = requests.post(f"{self.base_url}/v1/transactions/send", 
                               json=payload, headers=self.headers)
        return response.json()

    def execute_defi_action(self, provider: str, action: str, params: Dict[str, Any]) -> Dict[str, Any]:
        """Execute DeFi operations - swap, lend, stake, etc."""
        response = requests.post(f"{self.base_url}/v1/actions/{provider}/{action}",
                               json=params, headers=self.headers)
        return response.json()

# Usage in your AI agent
tools = WAIaaSTools("http://127.0.0.1:3100", "wai_sess_your_token_here")

# Agent can now check balance
balance = tools.get_balance()
print(f"Agent wallet: {balance['balance']} {balance['symbol']}")

# And execute DeFi operations
swap_result = tools.execute_defi_action("jupiter-swap", "swap", {
    "inputMint": "So11111111111111111111111111111111111111112",  # SOL
    "outputMint": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",  # USDC  
    "amount": "1000000000"  # 1 SOL
})

LangChain Integration Example

For LangChain users, OpenClaw tools can be wrapped as LangChain tools:

from langchain.tools import Tool
from langchain.agents import initialize_agent, AgentType
from langchain.llms import OpenAI

def create_waiaas_tools(waiaas_client):
    return [
        Tool(
            name="check_wallet_balance",
            description="Get the current wallet balance",
            func=lambda x: waiaas_client.get_balance()
        ),
        Tool(
            name="send_tokens", 
            description="Send tokens to an address. Input: 'address,amount'",
            func=lambda x: waiaas_client.send_token(*x.split(','))
        ),
        Tool(
            name="swap_tokens",
            description="Swap tokens on Jupiter DEX. Input: 'input_token,output_token,amount'", 
            func=lambda x: waiaas_client.execute_defi_action("jupiter-swap", "swap", {
                "inputMint": x.split(',')[0],
                "outputMint": x.split(',')[1], 
                "amount": x.split(',')[2]
            })
        )
    ]

# Initialize agent with wallet tools
llm = OpenAI(temperature=0)
waiaas_tools = create_waiaas_tools(WAIaaSTools(base_url, token))
agent = initialize_agent(waiaas_tools, llm, agent=AgentType.ZERO_SHOT_REACT_DESCRIPTION)

# Agent can now execute: "Check my balance and swap 0.1 SOL for USDC"
response = agent.run("Check my balance and if I have more than 0.1 SOL, swap it for USDC")

Session-Based Security

OpenClaw tools use WAIaaS’s session authentication system. Each AI agent gets a dedicated session with configurable permissions and spending limits:

# Create a session for your AI agent (requires master password)
curl -X POST http://127.0.0.1:3100/v1/sessions 
  -H "Content-Type: application/json" 
  -H "X-Master-Password: your-master-password" 
  -d '{
    "walletId": "your-wallet-uuid",
    "ttl": 86400,
    "maxRenewals": 30,
    "absoluteLifetime": 2592000
  }'

The session token (starting with wai_sess_) is what your AI agent uses for all operations. Sessions can be configured with spending limits, token whitelists, and time restrictions through WAIaaS’s 21 policy types.

Multi-Chain Support

Your agents can work across 18 networks spanning Ethereum, Solana, Polygon, Arbitrum, and more. The same OpenClaw tools work regardless of the underlying blockchain:

# Works on Solana
solana_swap = tools.execute_defi_action("jupiter-swap", "swap", {...})

# Same interface on Ethereum  
ethereum_swap = tools.execute_defi_action("zerox-swap", "swap", {...})

# Or cross-chain bridging
bridge_tx = tools.execute_defi_action("lifi", "bridge", {
    "fromChain": "ethereum",
    "toChain": "polygon", 
    "fromToken": "USDC",
    "toToken": "USDC",
    "amount": "100000000"
})

Getting Started in 5 Minutes

1. Install WAIaaS daemon:

   npm install -g @waiaas/cli
   waiaas init && waiaas start

1. Create a wallet and session:

   waiaas wallet create --name "agent-wallet" --chain solana
   # Note the wallet ID from output
   waiaas session create --wallet-id <wallet-id>
   # Note the session token from output  

1. Fund your wallet with some tokens for testing (send SOL/ETH to the wallet address)

2. Test the integration:

   tools = WAIaaSTools("http://127.0.0.1:3100", "wai_sess_your_token")
   print(tools.get_balance())

1. Integrate with your AI framework using the patterns shown above

Advanced Capabilities

Beyond basic transfers, your agents can access sophisticated DeFi operations through WAIaaS’s 15 integrated protocols:

• Lending & Borrowing: Aave, Compound integration with health factor monitoring
• DEX Trading: Jupiter (Solana), 0x Protocol (EVM) with slippage protection
• Liquid Staking: Lido (Ethereum), Jito (Solana) for yield generation
• Cross-chain: LI.FI and Across for bridging between networks
• Perpetual Futures: Hyperliquid integration with position management
• Prediction Markets: Polymarket for betting on future events

Each protocol is accessible through the same execute_defi_action interface, making it easy for agents to compose complex strategies.

Why OpenClaw vs Native MCP?

While WAIaaS provides 45 native MCP tools for Claude Desktop integration, OpenClaw’s 17 tools focus on the core wallet operations that any AI agent needs:

• Framework Agnostic: Works with LangChain, CrewAI, AutoGPT, custom agents
• Lightweight: 17 focused tools vs 45 comprehensive MCP tools
• REST-based: Simple HTTP integration, no stdio transport needed
• Self-contained: No additional dependencies or configuration files

For Claude users, the native MCP integration provides the best experience. For everything else, OpenClaw is your bridge to wallet functionality.

Ready to give your AI agents financial superpowers? Check out the WAIaaS documentation on GitHub and explore the interactive API reference at waiaas.ai.

For more advanced integration patterns, see Building Trading Bots with WAIaaS: 7 DeFi Strategies in Python and Self-Hosted Wallet Infrastructure: Why Your AI Agents Need WAIaaS.

Your AI agents are about to become a lot more interesting. Time to let them loose in DeFi.

WebMCP lets a website expose its features as structured tools that AI agents call directly, instead of scraping the DOM or reading screenshots. On May 19, 2026, at Google I/O, Chrome announced an origin trial (Chrome 149) that makes it testable on real traffic for the first time. The popular take is that this guarantees your site gets cited and gets referral traffic. The W3C draft does not say that. For sites that earn their living from citations, WebMCP may even sharpen the zero-click problem rather than solve it.

This guide is built from the primary source — the W3C Web Machine Learning Community Group draft — plus the Chrome for Developers origin-trial documentation, not from secondhand explainers. Where the popular framing and the spec disagree, this notes it. Figures and spec details reflect May 2026; WebMCP is a Community Group draft, not a finished standard, so specifics will move.

Why This Guide Exists

Search the web for WebMCP today and you get two kinds of articles: “what is it” explainers and marketing pieces promising it will make your site the one agents pick. Almost none separate what the spec normatively defines from what vendors hope it becomes. A few load-bearing claims circulating — that WebMCP mandates source citation, that it speaks JSON-RPC, that you register “resources” — are not in the current draft. If you plan a content or GEO strategy on those claims, you are planning on something that does not exist yet.

What Just Happened

WebMCP first shipped behind a flag in Chrome 146 in late 2025. The change that matters now: at Google I/O 2026 on May 19, Chrome confirmed WebMCP moves into a public origin trial in Chrome 149, with companion documentation published May 18. An origin trial means real sites can enable it on production traffic, not just developers toggling a flag. Support for Gemini in Chrome is described as coming, without a firm date.

Two practical limits from the origin-trial documentation are worth noting up front. Tool calls require an open tab or webview and cannot run headlessly. And cross-origin iframes do not get tool access by default; they need an explicit allow="tools" permission. Safari and Firefox have not committed, and realistic cross-browser support is not expected before late 2027; a polyfill (the @mcp-b/global package) is how teams reach other browsers in the meantime.

What WebMCP Actually Is

A page using WebMCP can be thought of as a Model Context Protocol server whose tools run in client-side JavaScript instead of on a backend. The authors are engineers from Microsoft and Google, working in the W3C Web Machine Learning Community Group, and the draft aligns with Anthropic’s MCP.

The normative API is small. A page calls navigator.modelContext.registerTool() with a tool that has a name, a natural-language description, a JSON Schema inputSchema, and an execute callback that does the work and returns a structured result. That is the whole core surface in the current draft. Optional annotations let a tool declare itself read-only or mark its output as untrusted, and an agent can request a user confirmation step mid-execution. Everything runs in a secure (HTTPS) context, scoped to the page’s own origin.

How the agent receives those tools is deliberately left open. The spec is explicit that, despite the name, it does not prescribe the format in which tools are exposed to the agent — a browser may surface them via MCP, a proprietary function-calling method, or anything else. The browser builds an “observation” of the page for the agent, and that observation often still includes a screenshot, not just the tool list. WebMCP reduces the agent’s reliance on guessing from pixels and DOM; it does not necessarily eliminate vision entirely.

The Citation Paradox

Here is the part the hype skips. GEO works because an AI answer cites a source and a fraction of users click through. WebMCP is built for a different motion: the agent calls a tool, gets a structured result, and completes the task inside the session. The more capable that motion becomes, the less reason there is for the user to ever leave the agent and visit your page.

For a transactional site — booking, checkout, quote, signup — that is good news. The agent completing the action is the conversion, and the action happens on your origin. For a content or reference site that monetizes attention, it cuts the other way. If an agent can call your tool and return the answer directly, the click that GEO depends on is exactly what gets removed. WebMCP can deepen the zero-click problem for publishers even as it helps merchants.

This is the honest frame: WebMCP is an opportunity if your value is an action, and a risk if your value is a click on a citation.

What the Hype Gets Wrong

None of this means WebMCP is vapor. It means the load-bearing GEO claim — guaranteed citation — is not real, and a strategy should not rest on it.

What It Actually Changes for GEO

Three real shifts, none of which is automatic traffic.

The tool description becomes a ranking surface. An agent picks which registered tool to call based on its name and description. That string is doing for agent selection what a meta description does for search snippets. Writing it well is a discipline of its own — clear scope, honest inputs, a result the agent can act on.

Origin reaches the model, but as trust signal, not attribution. Because the browser passes your origin to the agent for safety reasoning, a credible, consistent origin matters for whether the model is willing to call and trust your tool. That is reputational, not a referral link.

State and the single tab create a session, not a guaranteed visit. Tools only work while the tab is open, and they can appear or disappear based on page state. A genuinely useful dashboard tool keeps a tab alive, which is real engagement — but you cannot force a user to keep it open, and that is not the same as a citation click.

One Honest Caveat: The Security Model Isn’t Finished

WebMCP inherits the browser’s origin and HTTPS protections, but the draft’s security and privacy section is still unwritten, and there are open issues that matter for anyone exposing tools. A first- or third-party script sharing the page can overwrite a registered tool and quietly proxy the agent’s calls; prompt injection and data exfiltration through tool chaining are acknowledged but not resolved. Treat tool exposure the way you would treat any new public API surface on your site, and keep destructive actions behind the confirmation step instead of auto-executing them.

A Builder’s Hybrid: Keep the Static Layer

The pragmatic move is not to replace your GEO setup with WebMCP. It is to run both layers. Keep the static, citable content — clean prose, comparison tables, JSON-LD structured data — because that is what gets quoted in AI answers and indexed by search, and that is still where citation clicks come from. Add WebMCP tools on top for the actions an agent should be able to take directly. The static layer competes for the citation; the tool layer competes for the action. They are different funnels, and on most sites you want both.

A Minimal, Correct Example

The smallest honest version of a WebMCP tool — a read-only lookup that returns structured data. This is the imperative API as specified today.

// Register a read-only tool that an agent can call.
// Runs only while the tab is open; HTTPS (secure context) required.
navigator.modelContext.registerTool({
  name: "get_plan_pricing",
  description: "Return current plan names and monthly prices for this site.",
  inputSchema: {
    type: "object",
    properties: {
      currency: { type: "string", description: "ISO 4217 code, e.g. USD" }
    }
  },
  annotations: { readOnlyHint: true }, // does not change state
  execute: async (input) => {
    const plans = await fetchPlans(input.currency ?? "USD");
    // Include a next-step URL in the payload so the agent CAN surface it.
    // The spec does not force the agent to show it — this is best practice, not a guarantee.
    return { plans, source: location.origin + "/pricing/" };
  }
});

Note the comment on source. Returning a URL in your payload is the closest thing to “earning a citation” that you control — and even then, displaying it is the agent’s choice, not a protocol rule.

Which Move for Whom

FAQ

Does WebMCP guarantee my site gets cited or gets referral traffic?

No. The draft does not require agents to cite the origin URL to the user. The browser passes your origin to the agent as security information, and you can include a URL in your tool’s output, but whether the user sees a link is the agent’s choice.

Is WebMCP a finished W3C standard?

No. It is a Community Group draft (CG-DRAFT), explicitly not a W3C Standard and not on the standards track. It is being developed by Microsoft and Google engineers and aligns with Anthropic’s MCP.

Does it work in every browser?

Not yet. It shipped behind a flag in Chrome 146 and enters a Chrome 149 origin trial as of Google I/O 2026 (May 19, 2026). Safari and Firefox have not committed; broad support is not expected before late 2027. A polyfill exists for other browsers in the meantime.

Does it use JSON-RPC?

The spec does not prescribe the agent-facing format. Tool inputs are described with JSON Schema; how the browser exposes tools to the agent is implementation-defined.

Does WebMCP replace my structured data / JSON-LD?

No. They serve different funnels — static structured content competes for the citation, WebMCP tools compete for the action. Keep both.

Should I rebuild my site around it now?

Not yet. It is testable and worth experimenting with, but it is an evolving draft. Date your work and avoid betting a roadmap on the current API surface.

Sources

• W3C Web Machine Learning Community Group — WebMCP draft (CG-DRAFT): https://webmachinelearning.github.io/webmcp/
• Chrome for Developers — WebMCP (Chrome 149 origin trial): https://developer.chrome.com/docs/ai/webmcp
• WebMCP issue tracker (open security discussions): https://github.com/webmachinelearning/webmcp/issues

Originally published on rollbrains. Analysis based on public specifications and documentation as of May 2026. WebMCP is a Community Group draft, not a finished standard; verify current behavior against the W3C draft and your browser’s origin-trial status before relying on it.