Many business and consumer websites do not offer an API an AI agent can call. Pomerado is building a way to turn a described website task into a reusable MCP tool. The maker-authored Launch HN post on November 11 and the project's public repository describe a build step that explores a site and creates an integration; later calls use the generated workflow instead of asking an agent to navigate every screen from scratch.
How does Pomerado make a website workflow reusable?
In Pomerado's described flow, a developer gives the tool a site, a task and whether the integration should read information or make a change. The minter explores an example workflow, then builds and tests a site-specific integration. The local open-source version saves the generated code and exposes it as an MCP server; a connected agent can call the resulting tool with structured inputs. Pomerado says its Cloud service adds hosted jobs, managed browsers and automatic repair when a site changes.
This is different from a general-purpose browser agent that rediscovers the interface on every call. Pomerado says its generated operations are deterministic at runtime. That can make a repeated task easier to inspect and reuse, but it does not mean every run succeeds: a site can change its forms, authentication flow, permissions or data, so the integration and its output still need checking.
What is different between the local and hosted options?
The repository describes a local setup that runs on the user's machine and stores integration code in a folder the user owns. It requires an OpenAI API key to build an integration, but the repository says the key is read from the server environment rather than pasted into a chat. Its documented login flow types credentials into the site's sign-in page and says credentials are not saved by the local build. Answers, including passwords, still pass through the MCP client and its model provider, so the local label alone does not describe every system that may handle an answer.
Pomerado Cloud is a separate hosted service. Its site describes hosted integrations, credential storage as an option, authentication brokerage and managed browsers. Those are vendor descriptions, not an independent security assessment. Teams considering a hosted workflow should review the current data terms, retention details, access controls and any agreement they need before connecting credentials or sensitive records.
A login does not automatically permit automated access
The important boundary is the website being automated. Pomerado's Terms of Service say customers must have the rights and lawful basis to access third-party services and collect or use their information; possessing a login is not, by itself, permission for every automated activity. The terms prohibit unauthorized access and unlawful circumvention of access controls, and put responsibility on customers to define the allowed scope before enabling actions with financial or other material consequences.
That matters because Pomerado's product materials and a founder response on Launch HN discuss bot protection and CAPTCHA handling in the hosted service. A technical ability to reach a site is not the same as authorization from that site. Before building an integration, check the site's terms and your organization's rules, and use it only for activity you are allowed to perform. Do not point it at a service that prohibits the automation or use a solver or proxy to defeat a control you are not permitted to bypass.
Start with read-only work on information you are entitled to access. If a workflow can submit, purchase, message, change records or create a commitment, require a person to approve the exact action and re-read the result before retrying. The open-source repository notes that a cancellation cannot undo an action already sent to a website; the hosted terms likewise say completed actions may not be reversible. Keep credentials out of prompts where possible, restrict account scope, and avoid regulated data unless the needed contractual and security arrangements are in place.
When does a website-to-MCP integration make sense?
A stable, repetitive task on a system you own or are expressly authorized to automate is the clearest candidate. A one-off task may not justify building and maintaining a custom integration. A workflow on a third-party site with strict anti-automation rules, sensitive data or consequential write actions needs a permissions and risk review before it needs an agent.
Pomerado's launch makes website-to-MCP generation a timely option for developers to evaluate, not a blanket workaround for missing APIs. The useful question is not only whether an agent can perform the task, but whether the task is authorized, the credentials and data are handled appropriately, and a person can catch a wrong or duplicate action.
Read our guide to limiting an AI coding agent's access to your app project