WebMCP

WebMCP is a proposed browser standard that lets a web page hand an AI agent a set of typed, callable tools instead of making it read the screen and guess which button to click. An agent that would otherwise scrape your HTML can call search_catalog or get_shipping_estimate directly, the way a developer would call an API.

What you'll learn

• What WebMCP is, and what it does not do
• Where the standard actually stands today, versus how it is being marketed
• What we found when we measured Australian brands against it
• Whether it is worth your time yet, and how to check where you stand

What WebMCP is

WebMCP adds a document.modelContext object to the browser. A page calls registerTool() on it with a name, a description, a JSON Schema for the arguments, and a function to run. An agent inside that browser can then discover the tool and call it.

await document.modelContext.registerTool({
    name: 'check_delivery',
    description: 'Check whether we deliver to a postcode, and how long it takes.',
    inputSchema: {
        type: 'object',
        properties: {
            postcode: { type: 'string', description: 'Australian postcode, e.g. 2000' },
        },
        required: ['postcode'],
    },
    annotations: { readOnlyHint: true },
    async execute({ postcode }) {
        const result = await lookupDelivery(postcode);
        return { content: [{ type: 'text', text: result.summary }] };
    },
});

There is also a declarative form, where the browser builds a tool from an ordinary HTML form. No JavaScript required:

<form toolname="search-cars" tooldescription="Search available cars by make and model" toolautosubmit>
    <input type="text" name="make" toolparamdescription="The vehicle make, e.g. Toyota" required />
    <input type="text" name="model" toolparamdescription="The vehicle model, e.g. Corolla" required />
    <button type="submit">Search</button>
</form>

The declarative form is appealing for static sites, but the specification still lists schema synthesis and response handling as unresolved, so treat it as a preview rather than a finished feature.

Three things almost every guide gets wrong

The proposal has changed shape twice this year, and a lot of published tutorials were written against drafts that no longer exist.

Where the standard actually stands

This is the part most coverage overstates. WebMCP is a Community Group proposal, not a ratified standard, and it is not on the W3C Standards Track.

Two consequences follow, and they matter more than the version numbers.

First, your reach today is a slice of Chrome and Edge users, not "the web". Second, a site that has not enrolled in the origin trial cannot register a tool at all, which means any survey counting how many sites expose tools is partly measuring trial enrolment rather than intent.

What we found when we measured it

We scanned 181 Australian brands against Google's Lighthouse agentic-browsing category in August 2026. Two findings are worth carrying into any decision you make about WebMCP.

Almost nobody has hand-built a tool. Nine of the 175 sites we could scan exposed WebMCP tools. Every one of the nine was a Shopify storefront, and every one served the same ten tools from the same vendor bundle. Not one merchant wrote any code. Across banking, telco, travel, insurance, energy, government and education, we found nothing.

The score you will be shown is not measuring what you think. If a site has no agent tools, Lighthouse does not mark it down. It decides those checks do not apply and grades whatever is left, which is usually two general web-quality checks that predate agents entirely. Twenty-two sites scored a perfect 100% and eighteen of them expose nothing at all to an agent. We also watched a single unchanged site swing 77 points between two runs on the same day.

The full method, the site-level tables and the limitations are in the agent readiness benchmark.

The security questions the spec has not answered

This is where we would slow down, and it is the part vendor blog posts skip. These are not our objections, they are drawn from the proposal's own security and privacy questionnaire.

• Over-broad tools leak data. A tool can request far more personal information in its parameters than the task needs, and the specification names this as a live privacy risk.
• State can cross origins. An agent browsing several sites in one session may carry state from one origin to another.
• Tools can be invoked by script. Cross-origin documents and built-in agents can call a tool's execute callback directly, which is a new invocation path to reason about.
• There is no consent primitive yet. Hints for consequential actions are planned but not yet normative, and same-origin boundary enforcement is still marked as unresolved in the draft.
• There is no authentication story. A WebMCP tool inherits the page's session. That session is the authorisation. There are no scoped tokens, no per-tool consent, and no audit trail.

The practical rule that falls out of this: do not expose a tool that spends money, changes an account, or sends a message to a human until the consent story is settled. Read-only tools and tools that pre-fill a form for a person to confirm are a different risk class entirely.

Should you implement it yet?

A short decision guide, in the order we would actually ask the questions.

1. Are you on a platform that ships it? If you run Shopify, you already have ten tools and did nothing to get them. Check before you build. This is the most likely answer for retail.
2. Does an agent have something worth doing on your site? WebMCP is for actuation, not discovery. If your site's value is reading, not doing, tools add little. If your site has a search, a booking flow, a quote calculator or a catalogue, they add a lot.
3. Can you scope it to read-only? Start with tools that look things up and tools that pre-fill a form for a human to submit. That gives you the benefit with none of the unresolved consent risk.
4. Is your ordinary page quality sorted first? A well-formed page structure, a stable layout and an llms.txt are cheap, useful today, and read by systems that exist now. In our scan, 77% of Australian brands failed the page-structure check. Fix that before chasing an origin trial.

Where Outercite fits

We track the other half of the problem: whether AI engines cite your brand at all, across ChatGPT, Claude, Gemini, Perplexity, Grok and DeepSeek, with every citation verified twice before it reaches your dashboard.

The free AI visibility check reads your site the way an AI engine does and asks all six engines a generic question in your category, without naming you, so a citation has to be earned. It takes about a minute and needs no account. That is the honest place to start, because it answers the question that has revenue attached to it today, rather than the one that might in a year.

Related