# Call a WebMCP site's tools without a per-site adapter.

Ghostget's bundled `webmcp` adapter reads the public [WebMCP Registry](https://wmcp.ai/): sites that publish `navigator.modelContext` tools appear there with live-checked schemas. Search the registry, inspect one domain, and call tools declared read-only — all without an account, API key, or provider setup.

This guide describes v0.18.35. Registry content drifts between checks; the examples below return current results when you run them. The snapshot behind this site lists 1,802 domains as of 2026-09-23T07:17:21.268Z.

## Find a site

`sites.search` lists registered domains. All inputs are optional: `query` matches names and tool descriptions, `tag` filters by registry tag (`devtools`, `saas`, `ecommerce`, and others), `sort` orders by `popular`, `newest`, or `tools`, and `limit`/`cursor` page through results.

```
ghostget webmcp sites.search --input '{"query":"docs"}' --json
ghostget webmcp sites.search --input '{"tag":"devtools","limit":10}' --json
```

Each result carries the domain, site name, tool count, read-only count, tags, and a `nextCursor` for paging.

## Inspect one site's tools

`sites.get` returns the domain's current tools exactly as the registry last checked them: name, description, input schema, annotations, and the page URL the tool binds to.

```
ghostget webmcp sites.get --input '{"domain":"developers.cloudflare.com"}' --json
```

Read the `readOnlyHint` annotation per tool before planning a call. An unlisted domain fails closed with a structured provider error — the registry has no record to answer with.

## Call a read-only tool

`tools.call` invokes one listed tool through the registry's headless executor. Pass the domain, the exact tool name from `sites.get`, and the tool input as a JSON object literal string matching its schema.

```
ghostget webmcp tools.call --input '{
  "domain": "developers.cloudflare.com",
  "tool": "search",
  "input": "{\"query\":\"workers\"}"
}' --json
```

The registry executes the tool on the target domain in a fresh headless page and returns the site's response. Ghostget bounds the request, validates the envelope, and returns the site output as untrusted content inside the receipt.

## Limits

**Only `readOnlyHint` tools can be invoked.** A site may list mutating tools — purchases, writes, follows — that stay inspectable but cannot be called through the registry. Ghostget does not try to call around the gate.

**Results are the site's own words.** WebMCP tool output is untrusted third-party content returned verbatim in the receipt. Treat it like a page capture, not a verified fact.

**Schemas move with the site.** The registry re-checks domains continuously; a tool that appeared yesterday can rename its inputs today. Re-run `sites.get` rather than caching a schema, and let the structured provider error surface drift instead of retrying blindly.

**This is the public discovery lane.** Bundled adapters still own named services with accounts, previews, and mutation receipts. Use `webmcp` for the long tail; use a bundled adapter when the service has one.

## Keep exploring

Browse every registered domain on the [provider directory](https://ghostget.com/providers/), read the [WebMCP explainer](https://ghostget.com/webmcp/) for the boundary story, check `webmcp`'s attestation on the [provider capabilities](https://ghostget.com/docs/reference/provider-capabilities/) page, and read the [security guide](https://ghostget.com/docs/explanation/security-model/) for how provider calls stay bounded.