DEV Community

chovy
chovy

Posted on Originally published at dev.profullstack.com

W3BS is live: open standards for humans, agents and devices

#ai #webdev #standards #opensource

Originally published at dev.profullstack.com.

W3BS.org is an open standards initiative for a Web where people, AI agents, software and devices can discover, resolve and verify the same resource through any interface. Think of it as a W3C for the agentic era. It went live today at https://w3bs.org with community drafts, a reference stack you can run, and a public repository.

What is on the four sites

  • https://w3bs.org carries the mission, governance and the founding PRD.
  • https://specs.w3bs.org holds eight specifications. Three are implemented community drafts (URI, MANIFEST, RESOLVE) and five are proposals (SURFACE, PROMPT, TRUST, DELEGATION, DISCOVERY). No W3BS Recommendations have been issued.
  • https://prompt.w3bs.org is the reference registry: ten signed, versioned, MIT licensed prompts you can inspect, download and render.
  • https://browse.w3bs.org is the resolver. Paste a w3bs:// URI into an ordinary browser and see its canonical manifest, publisher, permissions, provenance and signature state.

The idea in one URI 

w3bs://prompt/w3bs/research@1
Enter fullscreen mode Exit fullscreen mode

That identifier resolves to the same signed manifest whether you ask the web page, the HTTP API, the CLI, the MCP server or the experimental native handler. The version alias picks the newest 1.x. A revoked version stays visible with its revocation, so a client is never silently downgraded to older code.

Try it from a checkout of the repository:

git clone https://github.com/profullstack/w3bs.org && cd w3bs.org && npm ci
W3BS_API=https://w3bs.org node src/cli.mjs resolve w3bs://prompt/w3bs/research@1
Enter fullscreen mode Exit fullscreen mode

Or from an MCP client, point it at https://w3bs.org/mcp and call w3bs_resolve. Machine discovery is at https://w3bs.org/.well-known/w3bs.json on every host.

What a manifest guarantees

Every resource is a JSON manifest canonicalized with RFC 8785 and signed with Ed25519. The registry pins publisher public keys to namespaces, so a valid signature from the wrong namespace fails verification. Content is data by default: a valid signature proves who published it, it does not authorize execution. Rendering a prompt template on the site requires an explicit consent checkbox, and the reference runtime never calls a model or a tool.

What is under the hood

The reference stack is one Node 24 service: Express 5, a PostgreSQL registry, the official MCP SDK for both stdio and Streamable HTTP transports, and a server-rendered site with a PWA offline state. A conformance script compares the API, CLI, HTML envelope, both MCP transports and the independent native client against each other and records the evidence in the repository. Fourteen protocol and trust-boundary tests plus eight desktop and mobile browser tests run on every push.

The source is MIT licensed at https://github.com/profullstack/w3bs.org with issues open. Governance and the contribution process are in the repository and at https://w3bs.org/governance.

What is not there yet

This is a founding stage release. Delegated execution, decentralized discovery, native mobile and desktop parity, a browser engine integration and outside implementations are on the roadmap, not in the build. The reference profile is labeled experimental on purpose. If you build agents, tools or devices that should be able to find and trust the same resource, the drafts are open for implementation and argument.

Top comments (0)