What it is
WebMCP — the Web Model Context Protocol — is a proposed web standard that lets a website tell an AI agent, in the agent’s own terms, what it can do. Rather than an agent scraping a page’s HTML and guessing which button submits a form or which link opens a checkout flow, a site running WebMCP can register a set of “tools” directly in the browser: named functions with plain-language descriptions and structured input schemas, similar to how a human developer would document an API. An agent visiting the page can then call search_products or add_to_cart the way it would call any other tool, instead of reverse-engineering the interface.
Technically, WebMCP is built around a new browser API, navigator.modelContext (exposed as document.modelContext in the current draft), through which a page can call registerTool(), list its tools with getTools(), and fire a toolchange event when what’s on offer changes. A simpler, declarative option lets developers annotate ordinary HTML form elements with tool names and descriptions instead of writing JavaScript. Crucially, this all runs client-side, inside the browser tab that the user (or the user’s agent) already has open — there is no separate server, no new authentication scheme, and no HTTP, SSE, or stdio transport layer. It borrows its vocabulary and tool-definition format from the backend Model Context Protocol (MCP), which Anthropic introduced in 2024 to let AI models call external tools and data sources, but WebMCP currently supports only MCP’s “tools” primitive — not the “resources” or “prompts” primitives from the original spec.
WebMCP is being developed jointly by engineers from Google’s Chrome team and Microsoft’s Edge team as a Draft Community Group Report under the W3C’s Web Machine Learning Community Group — an incubation venue, not yet an official W3C standard. It is implemented behind flags and in origin trials in Chrome (versions in the 146–149 range as of mid-2026), gated by same-origin restrictions and a tools permissions policy that defaults to same-origin contexts only.
Why it matters for AI governance and narratives
WebMCP sits at the center of a framing contest the observatory has been tracking under agent security and agents-as-actors: the industry’s push to make the web “agent-native” is being sold on efficiency grounds — it cuts the token and inference cost of having an agent parse and interpret raw DOM content, and it gives site owners a way to shape how agents represent their product rather than leaving that to scraping heuristics. That is the builder-ecosystem framing: fewer wasted tokens, more accurate task completion, no new backend to stand up.
But the same design that reduces context cost is what leaves the security story unresolved. A tool’s name and description are just text supplied by whoever controls the page, and an agent that trusts that text to decide what a “legitimate” action looks like is exposed to the same class of prompt-injection risk that already afflicts agents reading ordinary web content — except now the injected instructions arrive dressed as a structured, machine-readable capability rather than as suspicious prose. The spec’s own authors acknowledge this directly, devoting a security-considerations section to prompt injection via tool metadata, tool output, and the tool implementation itself. That an emerging standard ships with its own attack surface named and described in the spec text, rather than resolved by it, is itself a data point in the broader narrative about how fast agentic infrastructure is being built relative to how well its trust boundaries are understood.
Key facts and dates
WebMCP’s public lineage traces to MCP-B, an earlier community project (reported to date to around January 2025) exploring browser-native MCP implementations; Google and Microsoft are reported to have published a unified proposal around August 2025, with Chrome shipping an early preview by February 2026 (Chrome 146) and continued origin-trial availability reported into Chrome 149. The current editors of the W3C Community Group draft are listed as Brandon Walderman (Microsoft) and Khushal Sagar and Dominic Farolino (both Google); the draft spec was last dated August 26, 2026. As a Community Group Report, WebMCP has no formal standards-track status yet and remains subject to change. Beyond the browser vendors, developer interest has moved quickly: OpenAI ran a WebMCP-focused hackathon (the “WebMCP Challenge,” August 25–September 3, 2026) with Chrome, Cloudflare, Shopify, Vercel, Render, and Netlify as partners, indicating uptake beyond the two browser makers driving the spec.
Where to learn more
- WebMCP Draft Community Group Report — W3C Web Machine Learning Community Group — the primary technical specification, including the API definitions and the security-considerations section on prompt injection
- WebMCP | AI on Chrome — Chrome for Developers — Google’s official developer documentation, covering browser availability, origin-trial status, and permissions-policy gating
- webmcp.dev — community-run reference site tracking implementation examples and ecosystem tooling
- GoogleChrome/modern-web-guidance-src — WebMCP guide — Chrome team’s practical implementation guidance