Nishant Shukla
Show HN: A no-back end webpage that lets users bring their own coding agent
Last verified:
What is Nishant Shukla?
BYOA (Bring-Your-Own-Agent) is a novel approach introduced by Nishant Shukla that lets users hook up their own coding harness to control web applications without writing backend code. The core innovation is the
Nishant Shukla pricing
Pricing model: Freemium
The BYOA/spotsocket approach is completely free - Nishant Shukla explicitly states
Nishant Shukla pros
- Zero backend code required - only HTML/CSS/JS frontend
- No installation needed - nothing to install on user systems
- No hosting required - nothing to host yourself
- Lower setup effort compared to MCP servers
- Reduced token/context cost with progressive disclosure
- SKILL.md loaded only when relevant, not always in context
- Agents already know shell commands for CLI-like interaction
- End-user can read and modify skill instructions
- Works immediately - no waiting for browser API standardization
- Avoids browser fragmentation across Chrome/Safari/Firefox
- No new browser APIs required to interface with agents
- Lets users hook up their own coding harness
- Reduces vendor lock-in in AI agent orchestration
- Refactor frontend minimally to support WebSocket tool calls
- One-time cost to generate server, then cheap invocations
Nishant Shukla cons
- Requires browser tab to be open
- Server reachable by any local webpage, not just yours
- Running code your agent wrote that you probably won't read
- Security nightmare with generated code today
- No authentic scope - missing proper end-user identity management
- Requires agent allowed to run a server on localhost
- Agent must be on the same machine as the browser
- One-time generation cost for the WebSocket server
- Trust concerns with untrusted generated code
- Origin header checks needed to prevent Zoom-like failures
- Not an open standard like MCP
- No first-party support from major agents yet
- Only this blog post as maturity documentation
- Blast radius includes whatever generated server exposes
- Ephemeral software may disassemble promptly after use
Frequently asked questions about Nishant Shukla
What is BYOA (Bring-Your-Own-Agent)?
BYOA is the Bring-Your-Own-Agent approach where users hook up their own coding harness to control web applications. Instead of building MCP servers, CLIs, or hardcoded integrations, a SKILL.md file instructs the coding agent to generate a localhost WebSocket server that the frontend webpage connects to. This lets your coding agent control web interfaces like a kanban board without writing any backend code.
How does the spotsocket method work?
The spotsocket method works by having the browser dial out to a server running on your localhost (where the coding agent lives). A SKILL.md file asks the coding agent to generate a WebSocket server that the frontend can interface with. The agent then controls the web application directly - for example, reading ticket titles, inferring backend work, assigning tickets to people, and moving them to Done - all without any backend code being written.
How does spotsocket compare to MCP (Model Context Protocol)?
MCP requires building and hosting an MCP server with auth layer, rate limits, monitoring, and backwards compatibility management. Every tool definition sits in the context window. Spotsocket has no extra backend code, just frontend refactoring for WebSocket support. MCP has proper end-user identity management; spotsocket's server is reachable by any local webpage. MCP is an open standard with hundreds of servers; spotsocket is just this blog post.
How does spotsocket compare to CLI approaches?
CLI is a binary the agent shells out to, like any Unix tool. It's nearly free until invoked and discovered on demand with --help. However, CLI has trust and distribution problems - users installing binaries across an OS matrix with secrets on disk. The epic failure example is the xz-utils backdoor (CVE-2024-3094). Spotsocket requires no installation but has security concerns with generated code.
How does spotsocket compare to SKILL.md files alone?
A plain SKILL.md (like Anthropic's Agent Skills) depends entirely on what the skill instructs - anywhere from calling a hosted API to nothing at all. Spotsocket is specifically a SKILL.md that has the agent generate a localhost WebSocket server your webpage connects to. Both have progressive disclosure by design, but spotsocket adds the WebSocket server generation for direct browser-agent communication.
Why not just use WebMCP?
WebMCP is the closest formal version of this idea, predating spotsocket by a year. However, it's not widely available (requires Chrome 146 with navigator.modelContext behind a flag or a special extension), not standardized yet (browser-native features land slowly), and requires more plumbing (install MCP-B's local relay, drop a script tag, register as MCP server). WebMCP is Chrome-led by Google and Microsoft, risking fragmentation. Spotsocket leans on no new browser APIs and works now.
What are the security concerns with BYOA?
Security concerns include: running code your agent wrote that you probably won't read, the server being reachable by any local webpage (not just yours), prompt injection attacks (like Supabase's Cursor agent tricked by poisoned support ticket), and localhost server vulnerabilities (like Zoom's 2019 localhost server that went poorly). The skill should tell your agent to check the Origin header, and you should verify it did. Generated code isn't yet as trustworthy as typical dependencies.
What is the blast radius of spotsocket?
The blast radius is whatever the generated server exposes, plus the server itself is reachable by any local webpage, not just the creator's. This is wider than MCP (scoped to server's tools) or CLI (whatever the binary can do, which is everything you can do). The risk includes both the exposed API and the fact that any local webpage can reach the localhost server.
What is the future outlook for BYOA and generated code?
Nishant Shukla is optimistic that over the coming years, generated code will be as trustworthy and reliable as typical dependencies we already install without reading. He accepts the security nightmare today but entertains future possibilities including ephemeral software - built within seconds and disassembled promptly after use. The bet is that we've experienced a gradual retreat from skepticism of generated code over the last few years.