Public

FlightSweeper lets a browser agent complete a sandbox flight purchase without letting the model set its own authority.

The traveler sets exact, revocable limits. The agent searches and executes. FlightSweeper independently approves or denies the transaction and records why.

Project: Public, MIT-licensed WebMCP Challenge sandbox for judges and developers evaluating delegated transactions

Status: Submitted on August 28, 2026; available for public evaluation

Live challenge app: webmcp.flightsweeper.com

Source: github.com/raintree-technology/flightsweeper-webmcp

Submitted project: FlightSweeper on Devpost

Demo: Watch the 2:23 public video

This challenge edition never creates a real charge or airline order. It contains no production credentials, customer data, or private provider implementation.

FinSync LLC operates FlightSweeper and holds California Seller of Travel registration CST 2172984-70. Registration as a seller of travel does not constitute approval by the State of California.

Try the core flow

Prerequisite: Use ChatGPT desktop’s in-app browser or Chrome 149+ with WebMCP enabled.

1. Open the live challenge app.
2. Send the prompt below to the browser agent.
3. Watch the mission, offer, and evidence states change as the agent calls the registered tools.
4. Open Activity and Evidence to inspect the denial, authorization, ticket, and replay records.

Read the active flight mission and search for flights. Compare the visible offers. Select and evaluate the non-refundable Meridian offer, then explain why FlightSweeper denied it. Tighten the mission to nonstop, select Coast Air, refresh and evaluate it, then purchase it with idempotency key judge-demo-1. Repeat the purchase, revoke future authority, and retrieve the booking receipt.

What this proves:

• Untrusted supplier instructions cannot override the traveler’s stored rules.
• The agent can narrow authority but cannot grant itself more.
• A repeated purchase returns the original sandbox ticket instead of creating another transaction.

What is new for the challenge

The public challenge edition was created for the WebMCP Challenge after its August 25, 2026 kickoff. Production FlightSweeper remains private and unchanged.

The challenge work includes the sandbox, stable WebMCP catalog, and visible human-agent workspace. It also includes state-validated execution, monotonic authority, adversarial supplier content, policy evidence, and idempotent ticket replay.

Why WebMCP

The webpage, traveler, and agent share one transaction state. The traveler can replace or expand authority through the human interface. The agent can only narrow it.

The page keeps all 10 tools discoverable throughout the transaction. This stable catalog lets an agent plan the full workflow. Before each call, FlightSweeper checks the current mission state. An invalid call returns invalid_state, the current missionStatus, and validNextActions.

One sandbox supplier result includes an adversarial instruction. Provider-backed tools mark their content untrusted, and the application policy engine independently rejects the offer because it violates the stored mandate.

The challenge edition isolates the transaction rail. It demonstrates authority, policy, quote-binding, revocation, and idempotency controls. A live provider connection would require additional provider, payment, identity, operational, and regulatory controls.