Hitch tools you own, lent to a page you don't
Your agent sees nothing here Checking WebMCP

Bring your own tools to someone else’s website.

Hitch connects to servers you already control, shows you what they can do, and lends only what you pick to the AI agent in your browser. The page never sees the passwords behind them, and you can take everything back in one click.

—
passwords, keys or tokens on this page Checking what the server actually sent this page…
1

What you already own

Servers you control. Hitch asked each one what it can do. It never asked for the credentials behind them, and it could not use them if it had.

connecting
Connect a server of your own any MCP server, about four seconds

Paste any MCP server that speaks Streamable HTTP. Its tools show up below, and anything you lend becomes a live tool for your agent. The address and token go to our server once and come back as a handle that expires, so this page never holds your credential either.

2

What you lend the page

Finding a tool is not the same as handing it over. Nothing below reaches your agent until you lend it, one at a time.

3

What it does with them

Every call your agent makes shows up here, and you can take it all back.

Agent activity

0 calls
Run one yourself no agent required

Calls the exact function that was handed to your browser, so a click here and an agent’s request run the same code.

Then ask your agent for something that needs all three

Look up Anthropic, draft a short launch announcement for developers, then save it to my notes.

4

Take it to a website that isn’t ours

WebMCP hands tools to an agent through the page you are looking at, so Hitch has to run inside that page. Drag this to your bookmarks bar and it will, on almost any site you already use.

Hitch this page
Drag it up to your bookmarks bar. Then open any site below and click it. Your tools appear along the bottom, ready to lend to that page, for that visit only.

Verified working on

  • Shenandoah National Park Lend it weather and air quality, then ask if tomorrow is worth the drive.
  • IMDb Lend it your task list and ask it to add the film to your watchlist.
  • Open Library Research the author, then file a note about the book.
  • BBC News Draft a summary of a story in your own words and save it.

Click it on sites you already trust. The bookmarklet runs Hitch inside whatever page you are on, and a page you do not trust is not a page to lend tools to. Your credentials stay out of reach either way, but a lent tool is a real capability, so lend it somewhere you would be comfortable using it.

Some sites refuse injected scripts outright, Wikipedia and Hacker News among them. That is their content security policy doing its job, and it is the reason the durable version of this is a browser extension rather than a bookmarklet. Nothing about the model changes, only how the code gets into the page. There is also a worked example here if you want one that cannot fail on you.

What happens underneath

The part that keeps your credentials out of this page: our server does the talking, and the browser only ever learns a tool’s name and its inputs.

Your server
holds the credentials
n8n, or any MCP server
Hitch
asks what it can do
discover, classify, lend
Your browser
learns names, not secrets
registerTool()
Your agent
uses what you lent
and nothing else
0
tools lent to your agent
0
calls recorded
0
servers connected