Pomerado Website-to-MCP: Keyless Trials, Saved Logins, and What to Check Before You Add It

Pomerado, a Y Combinator–backed company that launched on Hacker News November 11, 2026, sells a hosted bridge: turn a website into MCP tools your coding agent can call without a bespoke scraper. The homepage publishes copy-paste claude mcp add and codex mcp add commands, a keyless MCP endpoint for trials, and an agent setup prompt that walks Claude Code through adding the server, testing find_website_tool, and optionally editing AGENTS.md to prefer Pomerado over browser automation. That is convenient—and it moves website credentials, 2FA, and third-party tool execution outside your laptop. If you run local agents, treat this like any other high-privilege MCP: understand transport, keys, and what gets stored before you paste the prompt.

Coverage of overlapping enterprise runtime guardrails appears in Bay AI Agent Security's November 10 launch; Pomerado is the complementary tool gateway layer many agents will reach for first.

TL;DR

What Pomerado documents

Product surface

Pomerado's public materials describe:

• Hosted integrations maintained when target sites change (marketing “self-healing” replay).
• MCP and REST access with tools such as find_website_tool, build_website_tool, and run_read_only_website_tool (names from homepage replays and getting started docs).
• Agent-authored integration builds, where Codex or Claude answer Pomerado's clarifying questions while a job runs (Coupa supplier portal example on the homepage).
• Saved logins with optional 2FA via SMS, authenticator, or email per the Logins UI replay.
• Pricing tiers (free tier: 100 tool calls/day, 10 new integrations/month per FAQ on the homepage).

Pomerado states it is open source on the marketing site; the integration hosting, login vault, and maintenance loops are vendor-operated regardless.

MCP connection paths

Two patterns matter for security reviews:

Authenticated path (docs):

claude mcp add --transport http pomerado 'https://mcp.pomerado.ai/mcp'

Docs say the Connect agent dashboard flow can create an API key when you open the page and embed it in the copied setup, or you sign in with a Pomerado account. Keys last 90 days per getting started documentation.

Keyless trial path (homepage):

claude mcp add --transport http pomerado https://mcp.pomerado.ai/mcp/keyless

The homepage explicitly promotes no account needed for initial read-only tasks. Shared keyless infrastructure is convenient for demos; it is a poor fit for portals with customer data unless Pomerado's contract and data-handling review say otherwise.

Codex users get parallel instructions: codex mcp add pomerado --url https://mcp.pomerado.ai/mcp/keyless.

The agent setup prompt (social engineering surface)

Pomerado's “Using an agent?” block tells operators to paste a multi-step prompt into the coding agent. Instructively, step 4 asks the agent to propose adding this line to AGENTS.md or CLAUDE.md:

For tasks on websites, use the Pomerado MCP before a browser.

Step 5 says when a task needs a website login, Pomerado gives a sign-in link the human must complete. That is safer than handing passwords to the model, but it still trains users to follow out-of-band auth links initiated by the agent—worth pairing with security awareness.

Docs also link https://docs.pomerado.ai/llms.txt for machine-readable discovery, a pattern more MCP vendors now ship.

Benchmark and cost claims on the homepage

Pomerado's launch page publishes quantitative comparisons readers should treat as vendor benchmarks, not independent audits:

• An employee onboarding replay claims 8 minutes 16 seconds and 3 cents via Pomerado versus 21 minutes 22 seconds and $41.01 for Codex Computer Use across HR, IT, courses, and library systems (video shown at 321× speed).
• A 30-task suite across 25 business apps claims 2× speed, 10–1,000× cheaper token costs versus Astra Computer Use, Instinct, and Muse, with 30% higher accuracy—with footnotes that costs use list model prices where competitors do not disclose usage.

Those numbers explain why agents may prefer hosted tools over browser loops; they do not replace your own measurement on the portals you care about (payer sites, ERP instances, internal vendor tools). Document baseline latency and error rates before delegating workflows.

Maintenance and “self-healing” behavior

The Anthem claims replay on the homepage illustrates failure handling: a date filter not found error triggers maintenance that reruns the failing step, patches the integration when the payer moved UI controls, and updates the original agent run with results rather than returning a raw stack trace to the model.

From a security lens, that means third-party code changing in flight on Pomerado's side between your tool calls. Version pinning is not something the MCP client sees. Change-management teams should ask:

• Whether integration updates are logged per tenant with diffs.
• How long saved logins remain valid across UI overhauls.
• Whether agents can request write tools (bookings, transfers) after starting with read-only demos.

The Coupa supplier portal replay shows interactive Q&A during builds (“include all three customers?”, “latest comment only on disputes?”). Those answers become integration behavior—store them in ticket systems, not only chat logs.

REST API path (parallel to MCP)

Docs describe a REST API with bearer tokens from dashboard API keys (90-day lifetime, permissions bounded except billing and key management). Example from getting started:

curl https://api.pomerado.ai/v1/account \
  -H "Authorization: Bearer $POMERADO_API_KEY"

Teams that block HTTP MCP might still allow REST from CI—but the same credential concentration risks apply. Keys created on the Connect agent page may be auto-generated when the page opens; avoid leaving that browser tab open on shared machines.

Attack and abuse angles (grounded, not hypothetical CVEs)

This is not a disclosed vulnerability; it is a trust-boundary shift:

1. Third-party tool execution. Each run_website_tool call executes logic Pomerado hosts. Compromise of Pomerado or a malicious integration update has the same class of impact as any remote MCP you enable—similar themes to transitive MCP dependency drift and npm MCP traffic hijacks.
2. Credential concentration. Saved logins for Target, Delta, Coupa, and similar portals centralize secrets that would otherwise stay in the user's password manager. Banks are already pushing back on agents using customer credentials (US banks blocking login-sharing agents); Pomerado positions itself as operator-mediated login, but your risk team still must approve it.
3. Keyless endpoints. Any MCP URL shared in READMEs becomes a supply-chain magnet—forks could point agents at attacker-controlled hosts if users paste without checking transport.
4. Integration builder privileges. The Coupa replay shows Pomerado signing in with saved credentials, mapping filters, and publishing tools after agent Q&A. A compromised agent session during build_website_tool could approve overly broad read scopes unless humans review published tools.

Pomerado's FAQ claims rate limiting, anti-bot handling, and PII redaction in stored integration data. Those are policy statements; enterprise adopters should map them to their vendor review checklist.

What developers are saying

The Launch HN thread is still thin on November 11, but one comment raises operational security:

• KallowayThayer asks how Pomerado handles session isolation and rate-limiting on heavy SPAs with bot protection—whether it uses edge caching or reparses the DOM every call. Pomerado did not answer in the first handful of comments we reviewed; treat performance and block-rate claims as vendor marketing until reproduced on your target sites.

What this means if you run AI coding agents

Concrete checks before mcp add:

After enabling:

• Watch agent transcripts for sign-in links you did not expect.
• Rotate Pomerado API keys on the 90-day cadence docs describe.
• For regulated data (health, finance), compare Pomerado to bank-run read-only MCP patterns in the US banking agent policy post rather than defaulting to stored passwords.

How Beam handles this

Beam overlaps where Pomerado meets your local harness:

• MCP config scanning runs heuristics (including version-pin checks) on files your agent loads before tools run on-device. It can surface a newly added HTTP MCP with a surprising host—useful right after an agent pastes Pomerado's setup prompt without showing you the diff.
• PreToolUse hooks on Claude Code and Codex can deny risky shell or network actions when workspace policy is in enforce mode and cached policy is present—Beam does not intercept Pomerado's cloud calls after tools are already registered.
• Redaction strips known secret formats from stored events if an API key leaks into a local log line.

Beam does not proxy MCP traffic, host integrations, or validate Pomerado's cloud-side login vault. It is not a replacement for vendor review.

Limits: scans are heuristic, not a full SBOM of remote tools; missing cached policy leaves hooks fail-open per Beam docs.

Corporate adoption checklist

Before security approves Pomerado for a team running Codex or Claude Code:

Align answers with how you already govern read-only bank MCP connectors versus password-sharing agents.

Frequently asked questions

See front matter for structured Q&A. In short: Pomerado is a hosted MCP + API for website tasks; keyless trials trade friction for shared infrastructure; saved logins concentrate secrets; agent prompts can modify your repo's instruction files—approve manually.

Related reading

• US banks block agents that use customer credentials
• Bay AI Agent Security runtime hooks launch
• CoreLight: uvx MCP transitive dependency drift
• Apex Accelerator npm MCP traffic hijack
• Postman installer and self-approved hooks

Pomerado URLs, pricing, and tool names reflect the vendor's November 11, 2026 homepage and docs.pomerado.ai getting-started page as of publication.