Agent-net Open Sources Webagent, a Go Harness That Turns Websites Into Guarded AI Agents

The harness is written in Go. An agent is one Brain, an LLM plus instruction, over a set of slots defined in core/. Each slot is a Service Provider Interface with a registry of providers in spi/ and a designated default. The slots cover retrieval, memory, guardrail, channels, secrets, presenter, model, action, and observability. Built-in defaults include live, keyword, and hybrid retrieval; session memory; basic or off guardrail; a2a, web, Slack, WhatsApp, and a Telegram stub as channels; env, file, and static secrets; text, terminal, and web presenters; echo, OpenRouter, and gateway models; none, demo, and MCP actions; and none, log, and memory observability.

The design serves three audiences on one contract: businesses that configure by picking from the menu, businesses that extend by registering a custom provider, and partner companies that ship adapters. Nobody forks the core, and every provider must pass its slot's conformance suite to be certified.

The most important architectural decision is action.Guard, according to the project. Every tool the agent holds, whether it comes from the action provider or is injected by the host, is wrapped so the chosen guardrail runs on the action before it executes. The model cannot bypass it. The DESIGN.md frames the project around a research finding that architecture, not model capability, decides agent success, citing arXiv 2511.19477 and an 85% versus 50% task-success gap on the same models.

The default echo brain needs no credentials, so webagent validate and webagent serve work out of the box on the two example specs, zomato.json and bakery.json. To drive a real model, webagent keys set openrouter stores a key in the OS config directory with mode 0600. Keys are never written into a spec, and an exported environment variable always wins. Both OpenRouter and gateway are OpenAI-compatible clients with a tool-calling loop.

A business with an existing MCP server becomes an acting agent with one spec block. The MCP action provider connects over Streamable HTTP, using JSON and SSE, with bearer or API-key authentication, performs the handshake at build time, and hands each tool to the agent behind the guard, so validate reports the real tool count. The Slack and WhatsApp channel adapters verify every inbound webhook signature, acknowledge immediately, reply through the platform API, ignore their own messages, and de-duplicate retried deliveries. Slack points at /slack/events, while Meta's callback goes to /whatsapp/webhook.

Secrets follow a naming rule: any config key ending in Secret is a reference resolved through the selected vault at build time, so specs are safe to commit. A reference that cannot be resolved fails the build rather than starting a channel without a credential. Observability emits a per-turn TurnTrace aligned to the OpenTelemetry GenAI conventions, and an eval/ harness runs scenarios with checks.

The repository ships under Apache 2.0, builds green, and runs live Slack, WhatsApp, and HTTP agents backed by MCP tools today. It is still labeled v0. The browser action provider, OAuth-gated MCP, OTel export, and the AgentNet identity and billing layer are listed as not yet built. MarkTechPost reported that the project's deferred-hardening list should be read before production use.