WebMCP: Letting Browser Agents Use Your Site's Own Tools

Fri, 23 Oct 2026 03:36:01 +0000

WebMCP is a proposed web standard that lets a page register its own tools, either JavaScript functions or marked-up HTML forms, which an agent in the visitor's browser can then call instead of feeling its way through buttons and inputs. In October 2026 it's a W3C Community Group draft with a Chrome origin trial, and the API changed during 2026, so many tutorials are already out of date.

I explain what it is and who's behind it, and summarise its status: an origin trial starting in Chrome 149, a flag for local testing, the move from navigator.modelContext to document.modelContext in May 2026, and early support elsewhere. Anything built now should feature-detect and fail silently.

The imperative API is registerTool(), with a name, description, input schema, callback and annotations including one that marks consequential actions like booking or paying. The declarative API turns an existing form into a tool with a few attributes. I compare WebMCP with a server-side MCP server: one lives in an open tab with the user's session, the other is a network endpoint any client can call, and Chrome's own guidance suggests using both for different jobs.

The security section covers HTTPS only, same-origin by default, a person in the loop and prompt injection as the main risk. I include a small business example and an honest list of when not to bother yet.

Key takeaways

WebMCP lets a page expose tools to in-browser agents
It's an experimental draft with an active Chrome origin trial
Forms can become tools with a few attributes
It complements, not replaces, a server-side MCP server
Mark consequential tools and validate everything server-side

Related on BuiltToWinWeb: adding a server-side MCP server

Read the full guide on BuiltToWinWeb: WebMCP explained, with a working example

A summary by Jacob Campbell of an article first published on built2winweb.com on October 7, 2026.

Coder Legion - Recent posts tagged web-standards

WebMCP: Letting Browser Agents Use Your Site's Own Tools

Key takeaways