Agent-net has released Webagent, an open-source Go harness that allows any website to function as a guarded AI agent.
The team behind the agent-to-agent marketplace has published the code on GitHub. Instead of writing complex orchestration logic, a business fills in a single declarative JSON specification. This spec defines one provider for each of nine pluggable slots. Running webagent serve then launches the agent.
Current capabilities and limitations
The repository ships under an Apache 2.0 license and builds successfully. It currently runs live Slack, WhatsApp, and HTTP agents backed by Model Context Protocol (MCP) tools.
However, the project is still labeled v0. Several features remain incomplete. These include the browser action provider, OAuth-gated MCP, OpenTelemetry export, and the AgentNet identity and billing layer.
Architecture and provider slots
Webagent is written in Go. An agent consists of one Brain, which combines a large language model with instructions, over a set of slots defined in the core/ directory. Each slot acts as a Service Provider Interface with a registry of providers in the spi/ directory and a designated default.
The following table outlines the available slots, their built-in providers, and defaults:
| Slot | Built-in providers | Default |
|---|---|---|
| Retrieval | live, keyword, hybrid | live |
| Memory | session | session |
| Guardrail | basic, off | basic |
| Channel | a2a, web, slack, whatsapp (telegram stub) | a2a |
| Secrets | env, file, static | env |
| Presenter | text, terminal (QR), web | text |
| Model | echo, openrouter, gateway | echo |
| Action | none, demo, mcp | none |
| Observability | none, log, memory | none |
This design serves three groups using a single contract. Businesses configure agents by picking from the menu. Others extend the system by registering custom providers. Partner companies ship adapters without forking the core. Every provider must pass its slot’s conformance suite to be certified.
Safety is enforced by code
The most important architectural decision is action.Guard. Every tool an agent holds, whether it comes from the action provider or is injected by the host, is wrapped so the chosen guardrail runs on the action before it executes. The model cannot bypass it.
The project’s DESIGN.md frames the whole effort around a research finding that architecture, not model capability, decides agent success. This cites arXiv 2511.19477 and an 85% versus 50% task-success gap on the same models.
What runs today
The default echo brain needs no credentials, so webagent validate and webagent serve work out of the box on the two example specs: zomato.json and bakery.json.
To drive a real model, webagent keys set openrouter stores a key in the OS config directory with mode 0600. Keys are never written into a spec, and an exported environment variable always wins. Both openrouter and gateway are OpenAI-compatible clients with a tool-calling loop.
A business with an existing MCP server becomes an acting agent with one spec block. The mcp action provider connects over Streamable HTTP (JSON and SSE) with bearer or API-key auth. It performs the handshake at build time and hands each tool to the agent behind the guard, so validate reports the real tool count.
The Slack and WhatsApp channel adapters verify every inbound webhook signature. They acknowledge immediately, reply through the platform API, ignore their own messages, and de-duplicate retried deliveries. Slack points at /slack/events; Meta’s callback goes to /whatsapp/webhook.
Secrets follow a naming rule: any config key ending in Secret is a reference resolved through the selected vault at build time, so specs are safe to commit. A reference that cannot be resolved fails the build rather than starting a channel without a credential. Observability emits a per-turn TurnTrace aligned to the OpenTelemetry GenAI conventions, and an eval/ harness runs scenarios with checks.
What it means for creators and businesses
The system lowers the barrier to deploying public-facing agents. Previously, building an agent required significant engineering effort to manage tool orchestration and safety. Now, a business can define its agent’s capabilities in a JSON file and run it immediately. The guardrail ensures that no tool executes outside the defined safety boundaries, protecting the agent from model-induced errors or malicious prompts. This allows teams to focus on business logic rather than infrastructure.
