WebMCP: how your website talks to AI agents.
WebMCP (Web Model Context Protocol) is a draft browser API from Google and Microsoft that lets a web page register its own actions — search, book, add to cart — as typed tools an in-browser AI agent can call instead of scraping. It is in origin trials in Chrome and Edge, supported by the ChatGPT desktop browser, and live on every Shopify storefront. Here is what it is, what it is not yet, and what “agent readiness” means for a normal business website in 2026.
- Draft W3C Community Group report
- Chrome & Edge origin trials
- Supported in ChatGPT Desktop
- Not a standard yet
Facts verified against the spec, repository and vendor documentation: October 2026. The draft changes often — treat API details as a snapshot.
First published by the W3C Web Machine Learning Community Group. Chrome early preview followed in February 2026.
Shopify switched WebMCP on for every Liquid storefront; the ChatGPT desktop browser added site-tool support the same month.
Browser engines on board: Chrome and Edge run origin trials. Mozilla is neutral with a prototype behind a flag. WebKit formally opposes.
Year-over-year growth in AI-agent requests seen by Cloudflare (September 2026). The traffic is coming whether sites are ready or not.
What WebMCP actually is
From the specification and README, not from vendor keynotes. Where the spec is still arguing with itself, we say so.
Tools in the page, not on a server
A page calls document.modelContext.registerTool() with a name, a description, a JSON Schema for the inputs and an execute() function. An agent in the browser can list those tools and call them in the user’s own logged-in session. The README’s own framing: pages become “in-page Model Context Protocol (MCP) servers that implement tools”.
Inspired by MCP, not the same thing
Anthropic’s MCP connects AI applications to server-side tools over JSON-RPC; it now lives under the Linux Foundation’s Agentic AI Foundation with more than 10,000 published servers. WebMCP borrows the vocabulary (name, description, inputSchema, annotations) and references MCP only non-normatively. Mozilla’s reviewer called the shared name “misleading”. Both things are true.
The declarative form API was just removed
Early drafts let you add toolname and tooldescription attributes to a plain HTML form and have the browser synthesise the tool. On October 8, 2026 the editors removed that from the spec “for now”. Chrome still implements it and documents it; OpenAI’s ChatGPT implementation never supported it. Build on the imperative API.
Permissions and hints, not trust
Tools are gated by a “tools” Permissions Policy (same-origin by default; cross-origin iframes need allow="tools"). Each tool can declare annotations — readOnlyHint, consequentialHint, untrustedContentHint — that let browsers and agents demand user confirmation before high-stakes actions. A mid-execution “ask the user” call is drafted but not shipped.
Where it runs today
Chrome: origin trial from version 149, extended to 162, plus a chrome://flags toggle and a DevTools WebMCP panel. Edge: origin trial listed in Edge 155 (October 2026). ChatGPT Desktop: site tools for Work and Codex users, with a safety review on every call. Gemini in Chrome: “coming soon” since I/O in May. Firefox: prototype behind a pref. Safari: no.
Who is experimenting
Google’s I/O 2026 wall named Expedia, Booking.com, Shopify, Credit Karma, TurboTax, Redfin, Etsy, Instacart and Target. Shopify shipped ten storefront tools (search catalog, get cart, proceed to checkout…) to every Liquid store on August 5, 2026 and checkout tools in late September. OpenAI ran a WebMCP Challenge with Chrome, Cloudflare, Shopify and Vercel in August.
A minimal tool registration
The first example from the WebMCP README, verbatim. Replace the function body with your own — the shape is the whole API.
await document.modelContext.registerTool({
name: "filter-templates",
description: "Filters the list of templates based on a natural language visual description.",
inputSchema: {
type: "object",
properties: {
description: { type: "string", description: "A visual description of templates to show." }
},
required: ["description"]
},
execute({ description }) {
filterTemplatesInUI(description);
}
});Source: webmachinelearning/webmcp README, fetched October 20, 2026. Names must be 1–128 ASCII characters; the return value is stringified for the agent.
From first draft to origin trials
- 13 Aug 2025
First published
WebMCP appears as a W3C Web Machine Learning Community Group draft, edited by engineers from Microsoft and Google.
- 9 Dec 2025
MCP joins the Linux Foundation
Anthropic, Block and OpenAI found the Agentic AI Foundation; MCP becomes a founding project. WebMCP’s server-side sibling gets neutral governance.
- 10 Feb 2026
Chrome early preview
Chrome announces WebMCP behind a flag with test extensions and the “Model Context Tool Inspector”.
- 19 May 2026
Origin trial and a logo wall
Google I/O: origin trial from Chrome 149, Gemini in Chrome support “coming soon”, and nine named experimenters from Expedia to Target. Spec scoped the API to Document the same day.
- Jun 2026
Mozilla neutral, WebKit opposed
Mozilla files a “neutral” position with a prototype. WebKit formally opposes: agents acting for users are assistive technology, so the gaps belong in HTML and ARIA.
- 5 Aug 2026
Shopify flips it on everywhere
WebMCP tools on every Liquid storefront and Hydrogen developer preview, “nothing to install or configure”. Checkout tools follow on September 28.
- 25 Aug 2026
ChatGPT Desktop support
OpenAI ships site tools in the ChatGPT desktop browser for Work and Codex, treats tool definitions as untrusted, and launches the WebMCP Challenge.
- 8 Oct 2026
Declarative API removed from the specNow
Form-attribute tools leave the draft “for now”; Edge 155 lists its own origin trial the same day. The imperative API is the one to build on.
WebMCP vs MCP vs llms.txt vs schema.org
Each solves a different problem. Only two of them have any measured effect today.
| Mechanism | What it is | Who reads it | Status, October 2026 |
|---|---|---|---|
| WebMCP | JavaScript tools registered in the page for in-browser agents | Chrome/Edge agents in origin trial; ChatGPT Desktop; Brave Leo (experimental) | Draft CG report; no shipping browser default |
| MCP | Server-side protocol connecting AI apps to tools and data | Claude, ChatGPT, Gemini, IDEs and 10,000+ servers | Open standard under the Agentic AI Foundation |
| llms.txt | A Markdown summary of the site at /llms.txt | Almost nobody: 97% of files get zero requests (Ahrefs, 137k domains, June 2026) | Proposal; Google says it is not used |
| schema.org structured data | Machine-readable facts about pages, products, organisations | Google, Bing/Copilot, and the search indexes AI answers draw on | Mature; Google says no special markup is needed for AI features |
What “agent ready” means for a normal website
WebMCP is the headline, but most sites fail agents at a far more basic level. These are the checks that matter today, with the evidence.
Render on the server.
The last published test (Vercel and MERJ, December 2024) found that none of the major AI crawlers — GPTBot, ClaudeBot, PerplexityBot, Meta’s — execute JavaScript; they download it and move on. No vendor has documented a change since. Content that only exists after hydration does not exist for agents.
Label your forms like you mean it.
Agents infer what a field is from its label, name and autocomplete attributes — the same things screen readers use. Chrome’s declarative experiment literally fell back to the <label> for the parameter description. Accessibility work is agent-readiness work.
Decide which bots you allow, by name.
Training crawlers and retrieval bots are separate tokens: GPTBot vs OAI-SearchBot vs ChatGPT-User (OpenAI), ClaudeBot vs Claude-SearchBot vs Claude-User (Anthropic), PerplexityBot vs Perplexity-User. Blocking the search ones removes you from answers; blocking the training ones does not. Check what your CDN does by default — Cloudflare has blocked AI crawlers for new sites since July 2025.
Let verified agents through the gate.
Cloudflare treats agents signing requests with Web Bot Auth (an IETF draft built on HTTP Message Signatures) as Verified Bots since July 2026; OpenAI, Google and AWS sign. A blanket CAPTCHA on every form stops the agent and the sale — keep human-only steps for the moments that need them, like submission.
Keep your facts consistent everywhere.
Agents cross-check your site against your Google Business Profile, Merchant Center, LinkedIn and review sites. Organization and Product structured data that matches the visible text is the cheapest trust signal you can ship.
Treat the agent as untrusted, and your page as a weapon.
Indirect prompt injection — hostile text on a web page steering an agent — is OWASP’s number-one LLM risk. Brave showed Perplexity’s Comet reading a user’s email OTP from hidden page text. Tool outputs you return can be turned against the user; keep them short, factual and free of instructions.
Eight checks, in the order we run them
This is the agent half of our website AI readiness check. You can run the first six yourself in an hour.
- 01
Fetch your key pages with JavaScript disabled
If the product, price, opening hours or form is missing, agents cannot see it either. Server-side rendering or static generation is the fix; it also helps classic SEO.
- 02
Read your robots.txt and CDN bot settings
List which AI user agents you allow. Make the training-versus-retrieval decision deliberately, per vendor, and write it down. Check whether Cloudflare or your WAF blocks “AI crawlers” wholesale.
- 03
Audit form semantics
Every input has a visible label, a sensible name and the right autocomplete token; errors are announced; the submit button says what it does. Run an accessibility checker — the overlap is nearly complete.
- 04
Validate structured data against the visible page
Organization, Product, Service, FAQPage, Offer — correct, consistent and not claiming things the page does not say. Google warns that mismatches get ignored.
- 05
Check entity consistency off-site
Name, address, phone, descriptions and categories identical on Google Business Profile, LinkedIn, directories and marketplaces. Ahrefs found brand mentions across the web correlate more with AI visibility than backlinks do.
- 06
Decide what agents may do, not just read
Search, filter, compare, prefill a form: safe to expose. Pay, delete, submit on the user’s behalf: keep a human confirmation. Write this down before you write any code.
- 07
Register WebMCP tools for the safe actions
One function per tool, verbs in the name, strict validation in code, readOnlyHint where true. Test in Chrome’s DevTools WebMCP panel and with the Model Context Tool Inspector extension. Join the Chrome and Edge origin trials so trial-enabled visitors see the tools.
- 08
Measure what arrives
GA4’s default “AI Assistant” channel groups referrals from ChatGPT, Gemini, Copilot and others; Cloudflare’s bot analytics show which agents fetch what. Decide now how you will know whether any of this moved a number.
What we ship, and what we do not claim
This website registers two WebMCP tools through document.modelContext: one returns structured facts about Wideweb, the other prefills our contact form with an inquiry. Neither tool submits anything — submission stays with the human, because our spam protection exists precisely to stop non-human submits. The component feature-detects the current API, falls back to the earlier draft names for polyfills, and does nothing in browsers without support.
We do not sell WebMCP implementation as a strategy, for the same reason we do not sell llms.txt: nothing measurable depends on it yet. A visitor on standard Chrome sees no tools unless the site is in the origin trial and their browser is agent-enabled. We ship it because it costs an afternoon, it is the direction every browser vendor except Apple is moving, and when the numbers start to move we would rather already be there than be selling you a rush job.
Agent readiness is one of eight things we check.
Our free AI readiness assessment covers your website’s readiness for AI search and agents alongside the business side: use cases, data, governance, EU AI Act exposure. One report, honest verdict.
Get the free AI readiness assessmentQuestions developers and owners ask
- Is WebMCP a web standard?
- Not yet. It is a Draft Community Group Report of the W3C Web Machine Learning Community Group — an incubation document, not on the W3C standards track. Google and Microsoft engineers edit it, Chrome and Edge run origin trials, Mozilla is neutral with a prototype, and WebKit (Safari) has filed a formal objection. Expect it to change; the declarative form API was removed from the draft in October 2026.
- Should we implement WebMCP now?
- If exposing a few safe, read-only actions costs you a day, yes — the API is small and Shopify has already done it for every storefront, so agents will expect it from commerce sites. If it would cost you a project, no: as of October 2026 no browser ships it by default, and the measurable gains are unproven. Spend that budget on server-side rendering, structured data and form semantics first; they help agents today and help Google regardless.
- What is the difference between WebMCP and MCP?
- MCP (Anthropic, now under the Linux Foundation) connects AI applications to tools that live on servers, over JSON-RPC. WebMCP registers tools inside a web page, in JavaScript, and lets an agent running in the user’s browser call them in the user’s logged-in session. Same vocabulary, different place and different trust model — WebMCP tools can see whatever the user can see.
- Does WebMCP replace llms.txt or schema.org?
- No, and they are not interchangeable. llms.txt is a text summary that, per Ahrefs’ 137,000-domain study, 97% of AI bots never request and Google says it does not use. Structured data is how search indexes — and therefore AI answers grounded in them — understand your pages. WebMCP is about actions, not understanding. Do structured data first, WebMCP when cheap, llms.txt only because it is free.
- Is it safe to let agents act on our site?
- It is as safe as the actions you expose. Keep tools read-only or reversible, validate every input in code, mark consequential tools so the browser asks the user first, and never let a tool submit payment or delete data without a human. Also assume hostile pages elsewhere will try to steer the agent: keep your tool outputs factual and free of instructions, and limit their length.
- How do we test it?
- Chrome 149 or later with the WebMCP flag enabled, or an origin trial token on your site. DevTools has an Application → WebMCP panel listing registered tools, schema errors and an invocation log, and Google publishes an example agentic extension and the Model Context Tool Inspector. Microsoft’s webmcp-labs repository has three reference apps. Angular ships experimental support; React has a use-webmcp-tool hook from Chrome Labs.
- Will Safari or Firefox ever support it?
- Firefox has a prototype behind a preference and a formally neutral position. WebKit objects on principle: agents acting for users are assistive technology, so the web platform should close gaps in HTML and ARIA instead of adding a parallel channel. Whatever happens, that objection is a useful reminder that accessible markup is the agent-readiness work with no downside.
Sources: WebMCP specification (W3C WebML CG draft) · webmachinelearning/webmcp — README, commits, implementation status · Chrome: WebMCP early preview (Feb 2026) · Chrome: imperative API reference · Chrome: WebMCP at I/O 2026 · Chrome Status: WebMCP origin trial · Chrome: agent security guidance · Microsoft Edge 155 release notes · OpenAI: WebMCP in ChatGPT · Shopify changelog: WebMCP on Liquid and Hydrogen · Mozilla standards position · WebKit standards position · Linux Foundation: Agentic AI Foundation (Dec 2025) · Cloudflare: the agentic web (Sep 2026) · Cloudflare: Verified Bots and Web Bot Auth · Vercel & MERJ: the rise of the AI crawler (Dec 2024) · Ahrefs: llms.txt study (Jun 2026) · OpenAI crawler documentation · Perplexity crawler documentation · OWASP Top 10 for LLM applications · Brave: prompt injection in Comet (Aug 2025)