[ChiragAgg5k]

appwrite.io now exposes 8 WebMCP tools that browser agents call inside the page (appwrite/appwrite#15549). Those calls never reach this server, so the MCP dashboard can't see them. This adds a beacon endpoint for appwrite.io to report each call to, recorded with the existing telemetry pipeline.

Change

• POST /webmcp/events (plus OPTIONS) takes {"tool", "status", "code"?, "durationMs"}. The page sends it with navigator.sendBeacon, a text/plain body, so there is no CORS preflight. It answers 204 with the shared CORS headers, 400 for a malformed event and 413 for a body over 1 KiB.
• New instruments:
  • mcp.webmcp.calls, a counter with tool_name, status and error_code labels (mcp_webmcp_calls_total in Mimir).
  • mcp.webmcp.duration, a histogram with a tool_name label (mcp_webmcp_duration_seconds_bucket in Mimir).
• Bounded labels: tool_name, status and error_code are checked against allowlists in constants.py, which mirror apps/console/src/lib/webmcp/site/tools.ts. Anything else counts as other, so an anonymous caller can inflate counts but can't create new series. The page never sends tool inputs or any identifier.
• Production only: a call is counted only when the beacon's Origin is https://appwrite.io. Preview, staging and local builds run the same page code; their beacons get 204 but are not recorded.
• Like the rest of telemetry.py, this records nothing unless OTLP export is configured.

The dashboard panels follow in appwrite-labs/monitoring, and the page-side beacon in appwrite/appwrite.

Tests

• New e2e class WebMcpEventsRoute in tests/e2e/test_tools.py:
  • Real HTTP beacons with a text/plain content type are counted through the real OTLP exporter into the test collector, including a made-up tool and status landing as other, and beacons from other origins (or with none) not being counted.
  • Malformed events get 400, oversized bodies 413, and preflight 204.
• Unit tests: 301/301. E2E tests: 66/66. ruff, black --check and pyright (0 errors) are all clean.

[appwrite]

🟢 Tier S · Ready to merge

Adds a public /webmcp/events beacon endpoint that accepts bounded, allowlisted WebMCP event data and records calls from https://appwrite.io. Adds WebMCP call and duration telemetry instruments, constants for allowed labels and limits, and end-to-end coverage for event counting, origin filtering, malformed payloads, and preflight requests.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 5

File	Change
AGENTS.md	Documents the new WebMCP beacon route.
src/mcp_server_appwrite/constants.py	Defines WebMCP label allowlists, the body limit, and the production origin.
src/mcp_server_appwrite/http_app.py	Adds the public POST/OPTIONS endpoint and event validation.
src/mcp_server_appwrite/telemetry.py	Registers WebMCP call and duration instruments and records reported calls.
tests/e2e/test_tools.py	Covers event counting, origin filtering, malformed events, oversized bodies, and preflight.

🔇 Filtered out · 1

Findings Hansi considered but did not post.

Finding	Why
Test that WebMCP durations reach the histogram	Verifier: The repo doesn't test the comparable histograms either (tool_duration and message_latency have no tests). Only session.duration does. Asking for a test of the webmcp_duration histogram is a missing-test nit that the repo's own practice doesn't back.

---

_{Reviewed 3b4e61c · Details · Comment @appwrite review to re-run, or mention @appwrite with a question.}

[ChiragAgg5k]

Closing in favour of recording WebMCP calls as appwrite.io analytics events in the console (appwrite/appwrite#15560). The tools belong to the site, so their telemetry belongs there too, without a public write endpoint or a tool list duplicated here.

[appwrite]

🟢 Tier S · Looks good to merge. Summary