For people who cannot upload the file

Give your agent the taste, not the recipe.

Let an agent analyse a confidential document without ever giving it the document.

Your document opens in this tab and never leaves it. An agent reads it through tools that pass on the meaning and hold back the names, accounts and figures you mark.

Open GuacaDoc →

No account. No upload.
No server to trust.

1
Open the file. It is read here, in the tab. Nothing is sent anywhere.
2
Mark what stays behind. Names, accounts, figures. Detection proposes, you decide.
3
Let the agent read. Through tools, one section at a time, on a record you keep.

Two panes side by side. On the left the contract as written, with names, an address, a phone number and dates highlighted. On the right the same text as the agent receives it, every one of those values replaced by a token such as [PERSON_01] or [ORG_02], and the bank account shown as [BLOCKED_IBAN] in brown.

The tool surface

Five tools go to document.modelContext.registerTool(), and every one of them answers through a single wrapper.

get_document_outline: Section ids, titles and sizes. No body text.
search_document: Which sections mention a term, with a short excerpt.
get_section: The text of one section, by id.
get_metrics: How much of the file has been served so far.
add_finding: Files one observation. Suspends on your approval.

The wrapper is the only door. It substitutes every string in a result after the handler has returned, so a handler cannot leak by forgetting to redact: forgetting is not a code path that exists. It also counts every byte of document text that leaves, holds write calls on your approval, and appends the audit line. Tools are registered against an AbortSignal per generation, because the API has no unregisterTool() and a remount would otherwise re-offer names the browser already holds.

How to try it

On any browser, right now

The Agent tab has a console that calls the same registered tools through the same wrapper. There is no privileged path and no demo mode: if the console cannot see a value, neither can a real agent. Press Sample investigation to watch four calls, or Read every section to hand the agent the whole file and watch it stay pseudonymous.

With a real agent driving the page

Chrome 149+ with chrome://flags/#enable-webmcp-testing, or ChatGPT's in-app browser.

The header reads webmcp absent · 0 tools on a browser without the API. That is the truth, not a failure: the count shown is the one the browser confirms holding, never the one this page offered, so it can never claim tools an agent has no way to call.

Why the tools run in the page

A server-side tool would have to receive the document before it could answer anything about it. That is the exact leak this exists to prevent, so the premise fails at step one.

The file never moves

Extraction, entity detection and substitution all happen in the tab. No model call, no request, no copy on anyone's disk.

Consent has somewhere to happen

A write tool suspends the agent's call on a prompt, in front of the person who owns the document. No timeout, no default answer.

The key stays with you

Tokens are minted here and reversed here. The mapping from [PERSON_01] back to a name is never transmitted, and never exported.

Checkable, not promised

Every call is written to a record in the tab, with its decision and the bytes it served. Open DevTools while you use it: the Network tab is empty, and it stays empty. Production builds tell the browser connect-src 'none', so this origin cannot open a connection even if the code asked it to.

38: entities detected
2: withheld outright
10: addressable sections
44: substitutions in the text

Measured at build time by the real detector on the bundled fictional contract, with the default level for each kind of value.

The agent view. A halved avocado meter reads the share of the file served to the agent, with 2 withheld values on its stone. A strip across the top shows each response that left the tab with its byte count. Below it, a record lists four calls, each marked allowed, and a key table whose real values are masked. — A real run of the sample investigation. The strip is everything that actually left the tab, the record is every call with its byte count and decision, the meter fills the flesh of a halved avocado and carries the withheld count on its stone, and the key is masked until you ask for it, because an agent driving this tab can read the screen.

What it does not do

It does not stop an agent that can see the screen

The tool surface is sealed; a screenshot of the source pane is not. This governs tool-mediated disclosure, which is the part WebMCP controls.

Detection is patterns, not a model

Regular expressions and a capitalization heuristic. It over-detects on purpose, and the review step exists because it will still miss things.

Enough narrow questions rebuild the redacted document

Nothing caps how much an agent may read, because rationing a text whose names are already gone protects nobody. What it rebuilds is the pseudonymized version, and every byte of it is on the strip and in the record.