WebMCP is a JavaScript API that lets a web page expose its functionality as tools AI agents can call. Instead of an agent scraping your UI, your page tells it exactly what it can do. In effect, every page becomes a client-side MCP server.
A JavaScript function with a natural language description and a JSON Schema for its inputs. Agents discover it, call it, and read its serialized result.
The registry of tools attached to every document, reached via document.modelContext. Register, list and execute tools through it.
An autonomous assistant acting on the user's behalf: built into the browser, an AI platform, or in-page JavaScript.
What a browser agent sees of the page: available tools, possibly with screenshots and the accessibility tree.
Three methods on document.modelContext carry the whole protocol:
await document.modelContext.registerTool({ name: "search_products", title: "Search Products", description: "Search product catalog", inputSchema: { type: "object", properties: { query: { type: "string" }, maxResults: { type: "number" } } }, execute: async ({ query, maxResults }) => { return { results: [ ... ] }; }, annotations: { readOnlyHint: true, untrustedContentHint: false } });
The security section of the draft reads like a pentester's checklist. These are the risks it names, and the ones our audit is built around:
Malicious instructions in tool metadata or outputs manipulate the agent: metadata poisoning, output injection, attacks on tool implementations.
A tool's description need not match its behavior. Authenticated tools can purchase, transfer or delete without explicit verification.
Over-parameterized input schemas quietly exfiltrate sensitive user data through tool parameters.
Cross-origin access requires explicit exposedTo grants; the "tools" permissions policy defaults to same-origin only.
Run them through the audit before an agent does it for you.