WebMCP: page-level tools for browser agents

What WebMCP changes

WebMCP lets a page expose structured tools to a browser agent in two ways. The declarative API annotates a standard HTML form with tool metadata, while the imperative API registers a JavaScript tool through document.modelContext.registerTool().

This is different from publishing a REST API or running a standalone MCP server. A browser tool does not automatically improve indexing or discovery, so AI Web Check shows it as experimental coverage.

What AI Web Check evaluates

The checker looks statically for declarative WebMCP form attributes and imperative document.modelContext.registerTool() registration in available inline script. It does not execute external JavaScript, so tools registered only after a full client-side render may not be visible to this test.

That limitation is deliberate: the result means “statically detectable” rather than “definitively absent”.

Minimal registration

The name and schema should describe one bounded action. Read-only and state-changing behavior should not be hidden behind a vague general-purpose tool.

await document.modelContext.registerTool({
  name: 'search_catalog',
  description: 'Search the public catalog by query',
  inputSchema: {
    type: 'object',
    properties: { query: { type: 'string' } },
    required: ['query']
  },
  execute: async ({ query }) => searchCatalog(query)
});

Security boundary

• Do not combine browsing, state changes, and payment into one unscoped tool.
• Use explicit input schemas and server-side authorization for any privileged operation.
• Treat irreversible actions as a separate trust boundary with confirmation or policy gates.
• Do not describe a normal OpenAPI endpoint as WebMCP when browser registration is absent.