webmend
Free · MCP 2026-07-28

Your visitors found the bugs.
Let your AI agent fix them.

Give Claude Code, Cursor, or any MCP client direct access to your bug reports on WebMend. It reads the screenshot, fixes the bug, and marks it done — no copy-pasting required.

Get an API token

What your agent can do

Six tools, and nothing it has to guess at.

Enough to work a backlog end to end: find what is open, read the whole report with the screenshot the visitor sent, and close it when the fix ships.

list_domains

Every domain you own or are a member of, with its report counts.

list_reports

Reports for one domain, filtered by status or priority.

get_report

One report in full — reporter, tags, notes, the screenshot, and suggested accessibility fixes.

update_report_status

Mark a report new, fixed, or won't-fix.

update_report_notes

Leave yourself notes on a report.

update_report_priority

Set or clear a report's priority.

Set up in two minutes

From zero to your agent's first fix.

Nothing to install and nothing to host. The server is ours; your client just needs to know where it is and who you are.

01

Verify your site

Prove you control the site in the dashboard. An agent only ever sees sites you verified.

02

Create a token

One personal API token in Settings. You see the full value once, when you make it.

03

Connect your AI

One line for Claude Code, or four for an mcp.json. Both are below.

04

Ask for something

“List my WebMend domains.” If it answers, you are connected.

Claude Code

claude mcp add --transport http webmend https://webmend.app/api/mcp --header "Authorization: Bearer <your-token>"

Cursor / mcp.json

{
  "mcpServers": {
    "webmend": {
      "url": "https://webmend.app/api/mcp",
      "headers": { "Authorization": "Bearer <your-token>" }
    }
  }
}

Good to know

What a token can reach, and what it cannot.

You are handing an agent a key to your reports, so the limits are worth reading before you make one.

Free

Connect an agent to any site you've verified. None of the six tools is gated.

A token sees only your domains

It is scoped to the account that made it, and to the domains that account owns or is a member of.

Revocable at any time

One button in Settings. Only the start of a token is stored, so a lost one is revoked rather than recovered.

Agent writes are labelled

Anything an agent changes shows as "Updated via API token" on the report page, so you can tell it from your own edits.

Screenshots are opt-in per call

A report only carries its image when the agent asks for it (include_screenshot).

60 a minute, 2000 a day

Per token. Enough for an agent working through a backlog, and a cap on one that has gone wrong.

FAQ

The questions worth asking before you hand over a key.

Not yet. Those need OAuth sign-in, which is on the roadmap. Today the server works with any client that can send a personal API token as a bearer header — Claude Code and Cursor both do.

No. A token is scoped to the account that created it, and within that account to the domains it owns or is a member of. There is no cross-account read.

Revoke it in Settings and make another. Only the first few characters are stored, so nobody — us included — can read a token back after it is created.

No. The server is ours and it is stateless: your client makes an HTTP request when it needs something. It speaks MCP 2026-07-28 over Streamable HTTP.