GenClass';
/** The MCP server for coding agents, pinned as its own install blocks pin it (packages/mcp/src/clients.ts). */
-export const MCP_PKG = "@genclass/mcp@0.2.0";
+export const MCP_PKG = "@genclass/mcp@0.2.1";
/** The package names and URLs installPrompt names; passed in, so the page script runs the same function. */
export interface PromptNames {
@@ -350,9 +350,9 @@ See priv
// ------------------------------------------------------------------------------------- /start/open-source
// GenClass's open-source parts with no account: the runtime in the app's pages, the agent link, the MCP server and the
-// page check, all Apache-2.0, with no token and the runtime's anonymous diagnostics off, so nothing reaches
-// genclass.dev. For teams that cannot sign up for or send data to a hosted dashboard (enterprises). The page sends
-// nothing either: its choices rewrite the prompt in the browser, with the server's own openSourcePrompt.
+// page check, all Apache-2.0, with no account: init creates the app's free dashboard link and keeps the runtime's
+// anonymous diagnostics on, as every init does (`--no-telemetry` for neither; owner decision 2026-11-02). For teams
+// that cannot sign up for a hosted dashboard. The page sends nothing either: its choices rewrite the prompt in the browser, with the server's own openSourcePrompt.
/** What /start/open-source's choices add to openSourcePrompt; all off is observe, the overlay in development only. */
export interface OpenSourceChoices {
@@ -369,10 +369,11 @@ export interface OpenSourceChoices {
}
/**
- * The prompt /start/open-source copies: installPrompt's steps without a token, a dashboard or an agent link, with
- * `telemetry: false` (the runtime sends no data anywhere; it still downloads public files from jsDelivr unless the app
- * serves them), the MCP server on the developer's machine and the page check run locally. Pure and self-contained,
- * like installPrompt: the page script runs this same function.
+ * The prompt /start/open-source copies: the two commands (`init --agent` for the app, `@genclass/mcp init` for the
+ * agent), with the app's free dashboard link and anonymous diagnostics on (never page text, never from local hosts;
+ * the browser downloads public files from jsDelivr unless the app serves them), no account, the MCP server on the
+ * developer's machine and the page check run locally; the choices are init flags. Pure and self-contained, like installPrompt: the page script runs this
+ * same function.
*/
export function openSourcePrompt(c: OpenSourceChoices = {}, n: PromptNames = PROMPT_NAMES): string {
const guard = !!c.guard;
@@ -380,69 +381,45 @@ export function openSourcePrompt(c: OpenSourceChoices = {}, n: PromptNames = PRO
const logs = !!c.logs;
const own = !!c.selfHost;
const dir = "/genclass-model/";
- // GenClass.init has automatic state discovery off unless asked (autoState: true, with the discover import first)
- const init = ["telemetry: false", "autoState: true"];
- if (guard) init.push('mode: "guard"', ...(eager ? ['aggressiveness: "eager"'] : []), "visual: { on: true, fix: true }");
- if (own) init.push(`model: { baseUrl: "${dir}", ortWasmPaths: "${dir}ort/" }`);
- if (logs) init.push("sinks: [consoleJson()]");
- // the script tag carries all of it but the aggressiveness, which goes in GENCLASS_CONFIG (as in installPrompt)
- const attrs = ['data-telemetry="off"'];
- if (guard) attrs.push('data-mode="guard"', 'data-visual="fix"');
- if (own) attrs.push(`data-model="${dir}"`, `data-ort="${dir}ort/"`);
- if (logs) attrs.push('data-sink="console-json"');
- attrs.push('data-devtools="local"');
- const flags = ["--no-telemetry", ...(guard ? ["--mode guard"] : []), ...(logs ? ["--sink console-json"] : []), ...(own ? [`--model-url ${dir}`] : [])];
- // init writes no visual or aggressiveness option: the prompt says where to add them
+ // every choice is an init flag, except the visual fixes and the aggressiveness, which init does not write
+ const flags = ["--agent", ...(guard ? ["--mode guard"] : []), ...(logs ? ["--sink console-json"] : []), ...(own ? [`--model-url ${dir}`] : []), "--yes"];
const initAdds = guard
- ? `${eager ? 'aggressiveness: "eager" and ' : ""}visual: { on: true, fix: true } to the option file it writes (data-visual="fix" on the tag it writes${eager ? ", and the GENCLASS_CONFIG line above" : ""}; Astro gets a line instead: add visual=fix to its content${eager ? ', and the aggressiveness in a window.GENCLASS_CONFIG script before it' : ""})`
+ ? `add ${eager ? 'aggressiveness: "eager" and ' : ""}visual: { on: true, fix: true } to the option file it writes (data-visual="fix" on the tag it writes${eager ? ', and a line before it' : ""}; Astro gets a line instead: add visual=fix to its content${eager ? ", and the aggressiveness in a window.GENCLASS_CONFIG script before it" : ""})`
: "";
- const local = '["localhost", "127.0.0.1"].includes(location.hostname)';
// A step is a one-element array, numbered at the end (choices add steps); other lines are strings. No named inner
// function: Wrangler's bundler (keepNames) would wrap it in a __name() helper that the page script, which runs this
// function's source, lacks.
const out: (string | [string])[] = [
- "Add GenClass's open-source parts to this web app (Apache-2.0, https://github.com/genclass-dev/GenClass): the @genclass/runtime library in its pages, which reports the bugs that never throw (double submits, stale responses that overwrite newer data, write races, visual bugs), and the @genclass/mcp server on this machine, so you, the coding agent, can see what happens on the dev pages, replay it and prove fixes. No GenClass account and no token: nothing is sent to genclass.dev. Do every step yourself.",
+ "Add GenClass's open-source parts to this web app (Apache-2.0, https://github.com/genclass-dev/GenClass): the @genclass/runtime library in its pages, which reports the bugs that never throw (double submits, stale responses that overwrite newer data, write races, visual bugs), and the @genclass/mcp server on this machine, so you, the coding agent, can see what happens on the dev pages, replay it and prove fixes. No GenClass account and nothing to sign in to: init creates the app's free dashboard link. Two commands do it; run them yourself.",
"",
- [`Install the runtime with the project's package manager: npm install ${n.pkg} (or pnpm add / yarn add / bun add ${n.pkg}). A site with no build step (plain HTML pages, no bundler) installs nothing: it uses the script tags below.`],
+ ...(own
+ ? [
+ [`Serve the model from the app itself, so its pages download no model from a CDN: npx ${n.pkg} fetch-model public/genclass-model (the folder the project serves as-is: public/ for Vite, Next.js and Astro, static/ for SvelteKit). It downloads the model and onnxruntime-web's files, checks the model files against the sizes and SHA-256 hashes its model card lists, and records onnxruntime-web's hashes in ort/ort.json; the next step's --model-url points at it. On a host with a 25 MiB per-file limit (Cloudflare), run fetch-model public/genclass-model --variant q8 --ort wasm instead (init --model-url adds device: "wasm" when it finds only the WASM build). With a bundler nothing else loads from a CDN. Without one, the runtime's script and what it loads on demand (its model worker, onnxruntime-web's JavaScript, sinks, visual checks, the overlay, the agent link) still come from jsDelivr unless you serve the package's dist/ folder from the app and point the script tag at it (--cdn GenClass without an account
The open-source parts only, Apache-2.0: the runtime in your app's pages, and the MCP server and the - page check on your machine. No sign-in, no token, and nothing is sent to genclass.dev.
+ page check on your machine. No sign-in: init creates the app's free dashboard link, and anonymous diagnostics stay on + unless you turn them off.
-
Paste it into Claude Code, Cursor or Codex: it adds GenClass to your app and the MCP server to the agent, with nothing to sign up for.
+Paste it into Claude Code, Cursor or Codex: two commands add GenClass to your app and the MCP server and the genclass skill to the agent, with nothing to sign up for.
What leaves your network
-
-
- Nothing goes to genclass.dev: there is no token, and the runtime's anonymous diagnostics are off (
telemetry: false).
+ - To genclass.dev: the app's package name, once, when
initcreates its free dashboard link (--no-tokenskips it); then, from public hosts only, the runtime's anonymous diagnostics: its decisions and counts, never text from the page (every field).init --no-telemetry --agentturns them off and creates no link, so nothing goes to genclass.dev at all. - Browsers download public files from jsDelivr (cdn.jsdelivr.net), once, then cached: the model and onnxruntime-web (about 13 MB on WASM, 18 MB on WebGPU) unless you serve them yourself, and on sites without a bundler the runtime's own files unless you serve its
dist/folder. No app data goes with those requests. - The MCP server runs on your machine and its bridge listens on 127.0.0.1 only; with
GENCLASS_DASHBOARDandGENCLASS_REPORTunset it sends nothing off the machine, and it keeps what it records in.genclass/agentin the project, which git ignores.genclass_scanandscan --localcheck pages in headless Chromium on your machine. A page URL leaves it only withhosted: true(orscanwithout--localwhen Playwright or its Chromium is missing): it then goes to GenClass's hosted page check (genclass-scan.mehar-144.workers.dev), which is not open source. - On developer machines, npm install and npx fetch packages from the npm registry (or your mirror), and the page check's Chromium comes from Playwright's download servers;
fetch-model(to serve the model yourself) downloads the model and onnxruntime-web from jsDelivr, or from a mirror you name with--fromand--ort-from. - The runtime, the MCP server, the model's training code and the collector behind genclass.dev are on GitHub under the Apache-2.0 license; the model's weights are on npm as
@genclass/runtime-model(Apache-2.0).
What you will see
+-
+
- In the browser console, once the model has loaded:
[GenClass] Model ready (…). Mode: observe., then one[GenClass] …line per detection, with its evidence.
+ - On localhost, the devtools overlay (bottom-right, Alt+Shift+G): what GenClass sees on the page, its checks and detections. +
- In your agent, once the MCP server runs:
genclass_statuslists the dev page (reload it after starting the server),genclass_findingswhat GenClass saw,genclass_explorethe race,genclass_replaythe proof.
+
Or run the commands yourself
- ${cmd("Add the runtime to your app", `npx ${RUNTIME_PKG} init --no-telemetry`)} - ${cmd("Connect the dev pages to the MCP server: Vite", `${AGENT_LINK_HEAD}\nif (import.meta.env.DEV && GenClass.runtime) connectAgent(GenClass.runtime);`)} - ${cmd("The same for Next.js and webpack", `${AGENT_LINK_HEAD.replace("the app's entry", "the app's entry (Next.js: instrumentation-client.ts)")}\nif (process.env.NODE_ENV === "development" && GenClass.runtime) connectAgent(GenClass.runtime);`)} - ${cmd("Add the MCP server for Claude Code", `npx -y ${MCP_PKG} init`)} + ${cmd("Add the runtime to your app, with the dev-only agent link", `npx ${RUNTIME_PKG} init --agent`)} + ${cmd("Add the MCP server and the genclass skill for Claude Code", `npx -y ${MCP_PKG} init`)} ${cmd("Check a page for visual bugs", `npx ${RUNTIME_PKG} scan http://localhost:5173/ --local`)} -init shows the diff and asks before it writes; add --mode guard for guard. Other agents: npx -y ${MCP_PKG} config <client> prints the block for Cursor, VS Code, Codex, Gemini CLI and others; keep GENCLASS_DASHBOARD and GENCLASS_REPORT out of it. The scan needs Playwright (npm i -D playwright && npx playwright install chromium).
init shows the diff and asks before it writes; add --mode guard for guard, --no-telemetry to send nothing to genclass.dev. Until the MCP server runs, a dev page logs one failed request to 127.0.0.1:47357 (the agent link finding no server). Other agents: npx -y ${MCP_PKG} config <client> prints the block for Cursor, VS Code, Codex, Gemini CLI and others; keep GENCLASS_DASHBOARD and GENCLASS_REPORT out of it. The scan needs Playwright (npm i -D playwright && npx playwright install chromium).