# webmcp

## What is WebMCP?

**WebMCP** (MCP over HTTP) is an implementation of the Model Context Protocol over standard HTTP/SSE requests. Unlike local MCP (stdio transport), WebMCP lets Claude and other MCP clients connect to remote MCP servers by URL without installing anything on the user's machine.

```
MCP Client → HTTPS → Your MCP Server
              ↑
     Standard HTTP/SSE transport
```

The endpoint is typically published at `/mcp` or `/.well-known/mcp`.

## Why do you need WebMCP?

Local MCP requires installing a server on every user's machine. WebMCP lets you offer MCP functionality as a SaaS service — the user adds a URL to Claude Desktop or another MCP client and gets the tool without any installation.

Key advantages:

- **Single update point** — the server is updated centrally; clients get new tools automatically.
- **OAuth authorization** — WebMCP servers support standard OAuth 2.0 discovery via [RFC 9728](/glossary/oauth-protected-resource).
- **Scalability** — the server is available to all clients simultaneously, rather than installed locally for each one.

## How do you implement WebMCP?

Use the MCP TypeScript SDK with HTTP/SSE transport:

```typescript
import { Server } from '@modelcontextprotocol/sdk/server/index.js';
import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';

const server = new Server({ name: 'my-mcp', version: '1.0.0' }, {
  capabilities: { tools: {} },
});

// Register tools
server.setRequestHandler(ListToolsRequestSchema, async () => ({
  tools: [{ name: 'scan', description: 'Scan URL for agent readiness', inputSchema: { ... } }],
}));

// HTTP endpoint
const transport = new SSEServerTransport('/mcp', res);
await server.connect(transport);
```

For an authorized WebMCP server, add OAuth discovery (`/.well-known/oauth-protected-resource`) as required by the MCP specification.

## How do we check WebMCP?

The WebMCP check in the current scanner version is **coming soon**. A full check requires a headless browser to verify `navigator.modelContext` — this is planned for scanner v2.

For now, the `webmcp` check does not affect the total score (weight = 0) and returns an informational status. Related checks that already work: [`oauth_protected_resource`](/glossary/oauth-protected-resource), [`mcp_server_card`](/glossary/mcp-server-card).

[← All glossary terms](/en/glossary)