WebMCP

What is WebMCP?

WebMCP is a browser JavaScript API from a W3C Web Machine Learning Community Group draft (authors from Microsoft and Google). A page registers “tools” via document.modelContext.registerTool(), and the browser’s AI agent calls them directly — instead of hunting for buttons and clicking through the DOM.

Browser AI agent → document.modelContext → execute() in the page
                                            ↑
                        site code under the user's session

WebMCP shares vocabulary with MCP (tools, a JSON Schema for input), but it is not the MCP wire protocol: there is no server endpoint, no transport and no URL to connect to. A remote MCP server (Streamable HTTP / SSE at a path like /mcp) is a separate mechanism.

Why do you need WebMCP?

An agent that drives a site through screenshots and clicks is slow and breaks on any layout change. WebMCP gives it an explicit list of actions with parameters.

Key advantages:

• Reliability — a function call instead of guessing UI elements.
• No separate backend — the tool runs in the page and reuses your client code and the user’s authorization.
• Transparency — the result of the action is visible to the user in the open UI.

Status as of October 2026: origin trial in Chrome 149 and Edge 150, supported in ChatGPT Desktop, experimental in Brave; Firefox and Safari have no position yet.

How do you implement WebMCP?

Register a tool from a page script:

const controller = new AbortController();

await document.modelContext.registerTool({
  name: 'search-products',
  description: 'Searches the product catalog by query',
  inputSchema: {
    type: 'object',
    properties: { query: { type: 'string', description: 'Search query' } },
    required: ['query'],
  },
  async execute({ query }) {
    const items = await searchProducts(query); // your existing function
    return { content: [{ type: 'text', text: JSON.stringify(items) }] };
  },
}, { signal: controller.signal });

// controller.abort() unregisters the tool

The API is available only over HTTPS (secure context). Agents inside the page or an iframe list tools via document.modelContext.getTools() and call executeTool(); a toolchange event fires when the set changes. Cross-origin iframes need allow="tools" and the exposedTo option.

Practices from the WebMCP README: few tools, each with a single responsibility; validate input, authorization and preconditions inside execute; keep the UI in sync with the agent’s actions. The declarative <form> variant was removed from the spec on October 8, 2026.

How do we check WebMCP?

The webmcp check is informational: it doesn’t affect the total score (weight = 0) and isn’t run yet — tools are registered from JavaScript, and the scanner doesn’t execute page scripts. More detail and manual verification steps are in the WebMCP guide.