# WebMCP explained: what it is, how it differs from MCP and what to do about it

WebMCP is a proposed web standard that lets a website offer its own actions, such as "search for a product" or "request a quote", as structured tools to an AI agent in the browser. The agent no longer has to read your page like a picture. It calls the function you exposed, while the user watches it happen.

*Last updated: 10 September 2026 · By Marc Diks*

## TL;DR

- WebMCP lets a website register JavaScript functions and HTML forms as tools an AI agent in the browser can call, via `document.modelContext` or a few extra attributes on a `<form>`.
- MCP (Model Context Protocol) connects AI apps to servers and works everywhere. WebMCP only works in an open browser tab, while the user is on your site. Google calls the two complementary.
- It is still experimental: an origin trial in Chrome 149 and Edge 150, a Community Group draft at the W3C, and Google says Gemini in Chrome will use the tools only "soon".
- Start with read actions (search, calculate, check status) and let the user press submit themselves for anything involving money or a contract.
- The biggest pitfall is an agent that carries out an irreversible action through your tool, steered by a manipulated instruction. The spec names prompt injection as the first risk.

## Key facts (with sources)

- WebMCP is a browser API that lets web applications offer JavaScript functions and HTML forms as tools to AI agents. Source: https://webmachinelearning.github.io/webmcp/
- The spec is a Draft Community Group Report from the W3C Web Machine Learning Community Group, latest version 9 September 2026, editors Brandon Walderman (Microsoft), Khushal Sagar and Dominic Farolino (Google). Source: https://webmachinelearning.github.io/webmcp/
- The imperative API is `document.modelContext.registerTool()`; earlier versions used `navigator.modelContext`. Source: https://developer.chrome.com/docs/ai/webmcp/imperative-api
- The declarative API uses the form attributes `toolname`, `tooldescription`, `toolparamdescription` and `toolautosubmit`. Source: https://developer.chrome.com/docs/ai/webmcp/declarative-api
- Tool annotations: `readOnlyHint`, `consequentialHint`, `untrustedContentHint`, default `false`. Source: https://webmachinelearning.github.io/webmcp/
- Chrome opened the WebMCP Early Preview Program on 10 February 2026. Source: https://developer.chrome.com/blog/webmcp-epp
- The origin trial runs from Chrome 149 and Edge 150; the Edge trial runs until 17 November 2026. Source: https://github.com/webmachinelearning/webmcp/blob/main/implementation-status.md
- Google (I/O, 19 May 2026): "Gemini in Chrome will soon support WebMCP APIs." Source: https://developer.chrome.com/blog/chrome-at-io26
- Google calls MCP and WebMCP complementary: MCP is persistent and works everywhere, WebMCP is bound to the browser tab. Source: https://developer.chrome.com/docs/ai/webmcp/compare-mcp
- MCP was introduced by Anthropic on 25 November 2024 and moved into the Agentic AI Foundation (Linux Foundation) on 9 December 2025. Source: https://www.anthropic.com/news/model-context-protocol
- Lighthouse has an agentic browsing category with audits for WebMCP tools, WebMCP schemas, forms missing declarative WebMCP, llms.txt, accessibility for agents and layout stability (Chrome 150+). Source: https://developer.chrome.com/docs/lighthouse/agentic-browsing/scoring
- Search volume for "webmcp" in the Netherlands: 8 in January 2026, 1,077 in February 2026 (Ahrefs Keywords Explorer, retrieved 10 September 2026).

## What is WebMCP, and why now?

WebMCP (Web Model Context Protocol) is a browser API that lets you, as a website builder, expose functions of your web application to AI agents. Such a function is called a tool. Every tool gets a name, a plain-language description and a schema that defines what input it expects.

An example makes it concrete. Say you run a webshop with a filter for size, colour and price. An agent operating that filter without WebMCP takes a screenshot, hunts for the right dropdown, clicks, waits, takes another screenshot. With WebMCP you register a single tool, `filter_products`, with three fields. The agent fills those in and your own code does the rest.

The standard comes out of the W3C's Web Machine Learning Community Group. The original authors worked at Microsoft and Google.

Five moments show how fast this moved: first publication of the proposal on 13 August 2025, Chrome opens its Early Preview Program on 10 February 2026, Google I/O announces the origin trial from Chrome 149 on 19 May 2026, the developer origin trial starts on 9 June 2026, and the latest spec draft is dated 9 September 2026. At the I/O announcement, Google showed logos of brands experimenting with WebMCP, including Expedia, Booking.com, Shopify, Etsy, Target, Credit Karma and TurboTax.

Search interest shows the same spike: from 8 Dutch searches for "webmcp" in January 2026 to 1,077 in February, the month of the early preview, followed by a sharp drop to about 84 a month from June onward. In the US, "webmcp" peaked the same month at 14,428 searches and then settled at a steadier floor of roughly 2,700 a month — developers there kept building with it, while in the Netherlands it more often stayed at curiosity.

WebMCP belongs to a broader shift often called the *agentic web*: a web where AI agents search, compare and act on people's behalf. More: https://www.marcdiks.nl/en/blog/agentic-commerce-2026 and https://www.marcdiks.nl/en/blog/do-we-still-need-websites-in-2026

## What is MCP (Model Context Protocol)?

MCP is an open standard for connecting AI applications to external systems: think of it as a USB-C port for AI applications. Anthropic introduced MCP on 25 November 2024 and moved it into the Agentic AI Foundation on 9 December 2025, a fund within the Linux Foundation it set up together with Block and OpenAI. Google, Microsoft, AWS, Cloudflare and Bloomberg back that foundation.

MCP has three roles: the host (the AI application, such as Claude, ChatGPT or a code editor), the client (the part that maintains one connection to one server) and the server (the program that supplies context and actions). An MCP server offers tools (functions), resources (data as context) and prompts (templates).

The 28 July 2026 specification made the core of MCP stateless and tightened authorisation; the main SDKs together see nearly half a billion downloads a month. Since 26 January 2026 there is also MCP Apps, an extension from Anthropic and OpenAI that lets a tool return an interactive screen inside the chat window. Keep the three terms apart: MCP (the connection), MCP Apps (an interface inside the chat) and WebMCP (tools on your own web page). More on MCP server risks: https://www.marcdiks.nl/en/blog/ai-skills-the-new-phishing

## What is the difference between WebMCP and MCP?

The short answer: MCP puts tools on a server, WebMCP puts tools on a web page. Both borrow the same vocabulary (tools, schemas, parameters), but they are separate standards with different governance.

| | MCP | WebMCP |
|---|---|---|
| Goal | Make data and actions available everywhere, always, for agents | Get a live website ready for direct interaction with an agent, during the user's visit |
| Lifespan | Persistent: a server that always runs | Temporary: exists as long as the tab stays open |
| Where it works | Everywhere: desktop, mobile, cloud, web | Only with agents in the browser |
| Who is signed in | A separate account, token or OAuth connection | The user's own session in the browser |
| Who builds it | Backend developers | Frontend developers |
| Who governs the standard | Agentic AI Foundation (Linux Foundation) | Web Machine Learning Community Group (W3C) |

Diagram (description): MCP runs from an AI app (host) via an MCP client and JSON-RPC (HTTP or stdio) to an MCP server that unlocks your systems. WebMCP runs from the user via an agent in the browser and document.modelContext to your web page and your existing frontend code.

```mermaid
flowchart LR
  subgraph MCP["MCP: tools on a server"]
    A1["AI app (host)"] --> A2["MCP client"]
    A2 -->|"JSON-RPC via HTTP or stdio"| A3["MCP server"]
    A3 --> A4["Your systems: CRM, database, API"]
  end
  subgraph WEB["WebMCP: tools on a web page"]
    B1["User in the browser"] --> B2["Agent in the browser"]
    B2 -->|"document.modelContext"| B3["Your web page"]
    B3 --> B4["Your existing frontend code and forms"]
  end
```

Google recommends using both, each for its own job: MCP for the core logic and reach beyond your site, WebMCP for interacting with your live interface at the moment a customer shows up. More on where agents run: https://www.marcdiks.nl/en/blog/ai-vendor-lock-in-kill-switch

## How does WebMCP work technically?

WebMCP gives two ways to build tools. The imperative API is JavaScript and gives full control. The declarative API is a handful of extra HTML attributes on a form you already have.

You register a tool via `document.modelContext.registerTool()` (earlier versions used `navigator.modelContext`). A tool consists of a name, a description, an input schema in JSON Schema, and an `execute` function:

```javascript
await document.modelContext.registerTool({
  name: 'calculate_scooter_premium',
  title: 'Calculate scooter insurance premium',
  description:
    'Calculates the monthly premium for scooter insurance based on ' +
    'postcode, year built and coverage. Does not conclude a contract.',
  inputSchema: {
    type: 'object',
    properties: {
      postcode: { type: 'string', description: 'Dutch postcode, e.g. 3401AB' },
      yearBuilt: { type: 'integer', minimum: 1990 },
      coverage: { type: 'string', enum: ['liability', 'liability_limited_casco', 'allrisk'] },
    },
    required: ['postcode', 'yearBuilt', 'coverage'],
  },
  annotations: { readOnlyHint: true },
  execute: async ({ postcode, yearBuilt, coverage }) => {
    const premium = await calculatePremium(postcode, yearBuilt, coverage);
    showResultOnPage(premium);
    return `Monthly premium: EUR ${premium.toFixed(2)}`;
  },
});
```

Three annotations help an agent judge how careful to be, all defaulting to `false`: `readOnlyHint` (only reads, changes nothing), `consequentialHint` (effects that are large, real or irreversible) and `untrustedContentHint` (output not to be blindly trusted).

If you already have a clean HTML form, a few attributes turn it into a tool:

```html
<form toolname="report_claim"
      tooldescription="Reports damage on an existing policy. The customer submits it themselves."
      action="/claims/report">
  <label for="policynumber">Policy number</label>
  <input type="text" id="policynumber" name="policynumber" required>
  <select name="type" required
          toolparamdescription="Type of claim: determines which team receives the report.">
    <option value="collision">Collision</option>
    <option value="theft">Theft</option>
    <option value="fire">Fire</option>
  </select>
  <button type="submit">Submit report</button>
</form>
```

`toolname` and `tooldescription` name the tool, `toolparamdescription` explains each field. The agent fills in the fields, but the user presses submit themselves — unless you add `toolautosubmit`.

Diagram (description): the user asks the agent in the browser a question; the agent calls getTools() to see which tools the page offers, calls executeTool() on the read-only tool calculate_scooter_premium, the page calculates with existing code and shows the result, and the agent returns the answer while the page visibly updates.

```mermaid
sequenceDiagram
  participant U as User
  participant A as Agent in the browser
  participant P as Web page
  U->>A: "What would allrisk cover cost for my scooter?"
  A->>P: getTools(): which tools exist?
  P-->>A: calculate_scooter_premium (readOnlyHint)
  A->>P: executeTool(postcode, yearBuilt, coverage)
  P->>P: existing code calculates, page shows the result
  P-->>A: "Monthly premium: EUR [amount]"
  A->>U: answer, with the page visible as proof
```

WebMCP only works over HTTPS and is separated by origin, under the `tools` Permissions Policy (default `self`).

## Why tools work better than an agent reading your screen

Agents could already operate websites without WebMCP: taking screenshots, reading the HTML structure, simulating clicks and keystrokes — slow and fragile. With WebMCP, the site states the purpose of a button or field itself. That's faster and makes fewer mistakes, keeps you in control of your own interface (the customer stays with you, sees your own terms, your own validation runs), and keeps the human in view: fully autonomous workflows without oversight are an explicit non-goal of the spec. Well-labelled forms, useful for screen readers, are usually also easy to turn into a declarative WebMCP tool. More: https://www.marcdiks.nl/en/blog/why-openai-is-becoming-your-competitor and https://www.marcdiks.nl/en/blog/accessibility-as-innovation

## What does WebMCP mean for your website, SEO and AI visibility?

AI visibility is about being found and cited; WebMCP is about the next step: once the user has arrived, can an agent do something on your site? Google has not said WebMCP counts toward your search ranking. Lighthouse does have an agentic browsing category (Chrome 150+) with audits for registered WebMCP tools, forms missing declarative WebMCP, WebMCP schema validity, llms.txt, accessibility for agents and layout stability — a baseline, not a proven ranking factor.

Schema.org, llms.txt and WebMCP each do something different: schema.org describes your page for search engines and AI systems, llms.txt gives language models a markdown overview, WebMCP offers actions an agent can execute. A strong site ultimately has all three. More: https://www.marcdiks.nl/en/ai-visibility and https://www.marcdiks.nl/en/blog/ai-overview-what-does-it-mean-for-your-website

## WebMCP in insurance practice

Insurance runs on forms: calculating a premium, requesting a quote, reporting a claim, changing an address, cancelling a policy. Sorted by risk: calculating a premium and comparing coverage can be `readOnlyHint: true` tools the agent runs itself; reporting a claim and changing an address are declarative forms without (address change: with) `consequentialHint`, the customer submits or confirms themselves; taking out a policy is better not offered as a tool yet; withdrawal or cancellation is declarative with confirmation (`consequentialHint: true`).

Since 19 June 2026, a consumer who takes out a contract online, including a financial service such as insurance, must be able to withdraw from it through a clearly visible withdrawal function (Directive (EU) 2023/2673). If you build a cancel button for people, the same flow, with a few attributes, can also become usable for a customer's agent — and the reverse obligation then applies: don't make it harder for an agent to cancel than to sign up.

For advisers, the duty of care still stands when an agent fills in a form: an agent that picks the lowest premium doesn't know the customer has an expensive e-bike. For advice-heavy products, WebMCP's value sits mostly in the early stage (fetching information, pre-filling data), less in the actual sign-up. More: https://www.marcdiks.nl/en/blog/withdrawal-vs-cancellation-beyond-compliance, https://www.marcdiks.nl/en/blog/dark-patterns-ban-cancel-button-2026 and https://www.marcdiks.nl/en/blog/uploading-customer-data-to-ai

## What risks does WebMCP bring?

The spec itself names five risks: (1) prompt injection via malicious instructions in a tool description; (2) misrepresented intent; (3) privacy leaks via excessive requested parameters; (4) cross-origin boundaries being bypassed; (5) unpredictable behaviour in private browsing. Agents can inherit identity, sign-in state, payment details and browsing history, and combine information across sites — an agent with that access reading a manipulated tool description can do a lot of damage.

Four countermeasures from the spec: limit the length of tool descriptions and input, use shared attack test suites, flag untrusted output with `untrustedContentHint`, flag tools with consequences with `consequentialHint`. What the spec does not arrange for you: approval of changing tools (there's a `toolchange` event), logging of agent calls, and server-side validation — never trust the schema alone. More: https://www.marcdiks.nl/en/blog/the-escape-how-ai-agents-hacked-their-way-out, https://www.marcdiks.nl/en/blog/ai-agents-own-language-you-cannot-read and https://www.marcdiks.nl/en/blog/ai-skills-the-new-phishing

## Browser support and standardisation: where does it stand?

September 2026: origin trial in Chrome (from 149, plus an Early Preview Program, test locally via `chrome://flags/#enable-webmcp-testing`) and Microsoft Edge (from 150, until 17 November 2026). Brave has experimental support in Leo. Firefox is tracking the proposal (open Bugzilla ticket); Safari's WebKit position is still under discussion. It is on by default nowhere.

A tool only has value once an agent calls it: Google said at I/O that Gemini in Chrome would support WebMCP "soon", but as of 10 September 2026 there was no confirmation this is already broadly live. The spec itself is a Draft Community Group Report, not yet on the formal W3C standardisation track; names and behaviour can still change, as the move from `navigator.modelContext` to `document.modelContext` already showed.

## The six biggest misconceptions about WebMCP

- WebMCP is a new version of MCP. In reality it's a separate W3C standard that borrows MCP's vocabulary but is governed separately.
- WebMCP lets any AI chatbot use your site. In reality it only works for agents running in the browser, in a tab where the user has your site open.
- WebMCP helps you rank higher in Google. There's no evidence for that; Lighthouse only gives a baseline via agentic browsing.
- An agent can just pay or cancel through WebMCP. In reality you decide which tools exist, and the user submits by default.
- WebMCP replaces your API or MCP server. Google calls the two complementary.
- You have to go all-in now or you'll be too late. A small test with one read action delivers more right now than a large project.

## How do you tackle WebMCP? (step-by-step plan)

1. Pick the five tasks customers do most often on your site.
2. Sort them by consequence: read-only, changes something, or money/contract.
3. Start with one read action as an imperative tool (`readOnlyHint: true`).
4. Annotate your most important form declaratively, without autosubmit.
5. Test locally (`chrome://flags/#enable-webmcp-testing`, Model Context Tool Inspector) and measure with the Lighthouse agentic browsing category.
6. Set up governance: approval of new tools, logging, server-side validation, `consequentialHint` policy.
7. Join the origin trial, or wait deliberately — and check at every new Chrome version whether anything changed.

Self-check: we know which five tasks customers perform most often; every task has a risk category and an owner; our forms are well labelled; we have tested one read action; new tools go through the same approval as a new API; agent calls are logged; input is always re-validated server-side; someone tracks the spec and the Chrome releases.

## WebMCP and the rules

Three frameworks for Dutch organisations (an assessment — have it checked legally): the GDPR (data minimisation — ask a tool for only what it needs); the EU AI Act (a website that only offers tools does not, by itself, place an AI system on the market; obligations sit primarily with whoever offers or deploys an AI system); consumer and sector rules (the withdrawal function from Directive (EU) 2023/2673 has applied since 19 June 2026 to financial services such as insurance too). More: https://www.marcdiks.nl/en/eu-ai-act, https://www.marcdiks.nl/projecten/ai-wet-impact-scanner and https://www.marcdiks.nl/en/ai-governance

## Frequently asked questions

**What is WebMCP?**
WebMCP (Web Model Context Protocol) is a proposed web standard that lets a website offer functions and forms as tools for AI agents in the browser. Every tool has a name, a description and an input schema; the agent calls the tool instead of hunting for buttons on a screenshot. The standard comes from the W3C and runs as an origin trial in Chrome and Edge in 2026.

**What is the difference between WebMCP and MCP?**
MCP (Model Context Protocol) connects AI applications to servers and works everywhere, even when the user isn't on your website. WebMCP puts tools on a web page and only works in an open browser tab, during the user's visit and with their sign-in session. MCP is backend, WebMCP is frontend.

**What is an MCP server?**
An MCP server is a program that supplies context and actions to AI applications via the Model Context Protocol: tools (functions), resources (data as context) and prompts (templates). A server can run locally or remotely over HTTP.

**Is WebMCP an official W3C standard?**
Not yet. WebMCP is a Draft Community Group Report, latest version 9 September 2026. Community Groups are open working groups within the W3C; their reports are not yet on the formal standardisation track that ends at a W3C Recommendation.

**Which browsers support WebMCP?**
As of September 2026: origin trial in Chrome (from 149) and Microsoft Edge (from 150, until 17 November 2026). Brave has experimental support in Leo. Firefox and Safari are still tracking the proposal. It is on by default nowhere.

**Should I put WebMCP on my website already?**
For most organisations, a small test is sensible and a large project premature. Start with one read action and well-labelled forms.

**Is WebMCP good for SEO?**
Google has not said WebMCP counts toward your search ranking. Lighthouse does have an agentic browsing category as a baseline.

**Is WebMCP safe?**
WebMCP only runs over HTTPS, is separated by origin, and falls under a Permissions Policy. Safety depends mostly on your own choices: which tools you offer, whether you flag consequences with `consequentialHint`, and whether you re-validate input server-side.

**Do I need a developer for WebMCP?**
For the declarative variant you need little code. For the imperative variant you write JavaScript, usually reusing your existing functions. Governance takes more than the code.

## Go deeper

- Agentic commerce: how AI agents are turning online retail upside down: https://www.marcdiks.nl/en/blog/agentic-commerce-2026
- Do we still need websites in 2026?: https://www.marcdiks.nl/en/blog/do-we-still-need-websites-in-2026
- Why OpenAI is becoming your competitor: https://www.marcdiks.nl/en/blog/why-openai-is-becoming-your-competitor
- AI visibility: https://www.marcdiks.nl/en/ai-visibility
- What an AI Overview means for your website: https://www.marcdiks.nl/en/blog/ai-overview-what-does-it-mean-for-your-website
- AI skills are the new phishing: https://www.marcdiks.nl/en/blog/ai-skills-the-new-phishing
- The escape: how AI agents hacked their way out of their cage: https://www.marcdiks.nl/en/blog/the-escape-how-ai-agents-hacked-their-way-out
- AI agents: in 5 days, a language of their own you can't read: https://www.marcdiks.nl/en/blog/ai-agents-own-language-you-cannot-read
- Uploading customer data to AI: what is and isn't allowed: https://www.marcdiks.nl/en/blog/uploading-customer-data-to-ai
- AI vendor lock-in: why the kill switch is your problem: https://www.marcdiks.nl/en/blog/ai-vendor-lock-in-kill-switch
- Withdrawal or cancellation: the new cancel button: https://www.marcdiks.nl/en/blog/withdrawal-vs-cancellation-beyond-compliance
- Dark patterns ban and the mandatory cancel button: https://www.marcdiks.nl/en/blog/dark-patterns-ban-cancel-button-2026
- Accessibility as innovation: https://www.marcdiks.nl/en/blog/accessibility-as-innovation
- EU AI Act: https://www.marcdiks.nl/en/eu-ai-act
- AI governance: https://www.marcdiks.nl/en/ai-governance

## Sources

- https://webmachinelearning.github.io/webmcp/
- https://github.com/webmachinelearning/webmcp
- https://developer.chrome.com/blog/webmcp-epp
- https://developer.chrome.com/blog/chrome-at-io26
- https://developer.chrome.com/blog/ai-webmcp-origin-trial
- https://modelcontextprotocol.io/docs/getting-started/intro
- https://www.anthropic.com/news/model-context-protocol
- https://blog.modelcontextprotocol.io/posts/2025-12-09-mcp-joins-agentic-ai-foundation/
- https://modelcontextprotocol.io/docs/learn/architecture
- https://blog.modelcontextprotocol.io/posts/2026-07-28/
- https://blog.modelcontextprotocol.io/posts/2026-01-26-mcp-apps/
- https://developer.chrome.com/docs/ai/webmcp/compare-mcp
- https://developer.chrome.com/docs/ai/webmcp
- https://developer.chrome.com/docs/ai/webmcp/imperative-api
- https://developer.chrome.com/docs/ai/webmcp/declarative-api
- https://developer.chrome.com/docs/lighthouse/agentic-browsing/scoring
- https://eur-lex.europa.eu/legal-content/NL/ALL/?uri=CELEX%3A32023L2673
- https://github.com/webmachinelearning/webmcp/blob/main/implementation-status.md
- https://developer.microsoft.com/en-us/microsoft-edge/origin-trials/trials/0b76fe60-b266-458e-a285-04e375c0c31a
- https://eur-lex.europa.eu/legal-content/NL/TXT/?uri=CELEX:32016R0679
- Ahrefs Keywords Explorer, NL and US search volumes for "webmcp", retrieved 10 September 2026

Canonical: https://www.marcdiks.nl/en/webmcp
Author: Marc Diks (https://www.marcdiks.nl/en/about)
Last updated: 2026-09-10