News

WebMCP: the new protocol transforming the web into an interface for AI agents

February 24, 2026

Google launches WebMCP in Chrome 146: a web standard that lets sites expose structured tools to AI agents. Complete guide for early adopters.

WebMCP: the new protocol transforming the web into an interface for AI agents

Summary

On February 10, 2026, Google launched an early preview in Chrome 146 Canary of a new web standard called WebMCP (Web Model Context Protocol). Co-developed by engineers from Google and Microsoft within the W3C Web Machine Learning Community Group, WebMCP allows websites to expose structured functionalities — “tools” — directly to AI agents via a new browser API: `navigator.modelContext`. Instead of scraping the DOM or analyzing screenshots, agents now call well-defined functions with precise input/output schemas. This protocol represents a major opportunity for developers and businesses ready to adopt it early.

Context: from MCP backend to WebMCP frontend

The Model Context Protocol (MCP) by Anthropic

The Model Context Protocol was introduced by Anthropic in November 2024 as an open standard for connecting AI assistants to external data sources and tools. Based on JSON-RPC 2.0, MCP follows a client-server architecture inspired by the Language Server Protocol (LSP). It was adopted by OpenAI, Google DeepMind, and many companies — Block, Stripe, Cloudflare, JetBrains, IBM — who developed MCP servers to expose their services. In December 2025, Anthropic transferred MCP to the Agentic AI Foundation, under the Linux Foundation, co-founded with Block and OpenAI.

The problem: to expose a website’s functionalities via MCP, you had to write a separate backend server in Python or Node.js, manage OAuth authentication, and maintain an infrastructure distinct from the web application itself.

The origin of WebMCP: Amazon’s MCP-B

The story begins at Amazon, where engineer Alex Nahas developed MCP-B (Model Context Protocol for Browser) to solve authentication problems for internal agents using thousands of MCP tools. His idea: run the MCP server directly in the browser, using existing user sessions and `postMessage` for communication. This open source project caught the attention of Chrome and Edge teams, leading to a convergence between Google and Microsoft on a unified specification published on GitHub in August 2025.

What is WebMCP exactly?

WebMCP is a web standard proposed by the W3C that allows browsers to expose structured tools to AI agents via the `navigator.modelContext` API. Each web page becomes a client-side “MCP server”: developers register JavaScript functions with natural language descriptions and JSON Schema schemas — the same format that Claude, GPT and Gemini already use for function calling.

Core principles

  • The site is the server: no separate backend, tools execute in the page’s JavaScript context.
  • Human-in-the-loop: the design requires user confirmation for sensitive operations via `requestUserInteraction()`.
  • Complementary to MCP: MCP connects agents to backend services, WebMCP connects them to browser interfaces. Both coexist.
  • Shared session: the agent inherits user authentication (cookies, sessions), eliminating complex OAuth flows.

The two APIs

WebMCP offers two complementary integration modes:

Declarative API (HTML)

No JavaScript required for simple cases. `toolname` and `tooldescription` attributes are added to existing HTML forms. Chrome automatically generates a structured schema that agents understand immediately.

```html

```

The server can distinguish human submissions from agent submissions through the `SubmitEvent.agentInvoked` flag.

Imperative API (JavaScript)

For dynamic and complex interactions, the developer registers tools programmatically with full control:

```javascript navigator.modelContext.registerTool({ name: "searchFlights", description: "Search available flights between airports", inputSchema: { type: "object", properties: { origin: { type: "string", pattern: "^[A-Z]{3}$" }, destination: { type: "string", pattern: "^[A-Z]{3}$" }, date: { type: "string", pattern: "^\\d{4}-\\d{2}-\\d{2}$" } }, required: ["origin", "destination", "date"] }, async execute({ origin, destination, date }) { const results = await flightAPI.search({ origin, destination, date }); return { content: [{ type: "text", text: JSON.stringify(results) }] }; } }); ```

The main API methods are:

Performance and measured gains

MethodRole
`registerTool()`Exposes a functionality to agents
`unregisterTool()`Removes a permission
`provideContext()`Sends contextual data to the agent
`clearContext()`Protects privacy
`requestUserInteraction()`Pauses the agent for user confirmation

Early benchmarks show significant gains compared to current agent-browser interaction methods:

MetricCurrent method (screenshots/DOM)WebMCPGain
Tokens per interaction2,000+ tokens/screenshot20-100 tokens/call~89%
Computational overheadBaseline-67%2/3 reduction
Task accuracyVariable, fragile~98%High reliability
Resilience to UI redesignsBreaks with every CSS changeStable (semantic contracts)Zero maintenance

The explanation is simple: instead of an agent sending a 2,000+ token screenshot to a multimodal model to guess where a button is, it directly calls `buyTicket(destination, date)` in 20-100 tokens.

Security model

Security is at the heart of WebMCP’s design, with native integration into the browser’s security model:

  • Same-Origin Policy: tools inherit the security boundary of their page’s origin.
  • Content Security Policy (CSP): WebMCP APIs respect CSP directives.
  • HTTPS required: only available in secure contexts.
  • Pair-wise consent: the browser requests approval for each site + agent pair (e.g., “Gmail + Claude”).
  • Destructive annotations: tools can be marked `destructiveHint` to flag dangerous operations.
  • Domain isolation: tools are scoped to specific domains with hash verification.

The “lethal trifecta”: an identified risk

The spec identifies a risk scenario called the “lethal trifecta”: an agent reads emails (private data), parses a phishing message (untrusted content), then calls a tool from another domain to exfiltrate that data. Each step is legitimate in isolation, but together they form an exfiltration chain. Prompt injections worsen this risk. Mitigation mechanisms exist but don’t fully eliminate it.

The WebMCP ecosystem today

Who is behind it?

Available tools

ActorRole
GoogleSpec co-author, Chrome 146 implementation
MicrosoftSpec co-author, probable Edge support
W3C Web ML Community GroupStandardization
Alex Nahas (ex-Amazon)Creator of MCP-B, precursor
Anthropic / Linux FoundationBackend MCP (parent protocol)

The tooling ecosystem for starting WebMCP development is already in place:

  • MCP-B Polyfill: `@mcp-b/webmcp-polyfill` implements `navigator.modelContext` for browsers without native support. One line of code is enough and the polyfill automatically disables when native support is detected.
  • React Hooks: the `usewebmcp` package provides React hooks for tool registration.
  • TypeScript SDK: `@mcp-b/webmcp-types` for strict TypeScript definitions.
  • Chrome Extension: the Model Context Tool Inspector allows debugging WebMCP tools.
  • Complete Runtime: `@mcp-b/global` combines the core polyfill + MCP bridge extensions.

```html ```

Concrete use cases

E-commerce and “Agentic Commerce”

WebMCP allows online stores to expose tools like `checkStock(item_id)`, `addToCart(product, quantity)` or `checkout(shipping_method)` directly to agents. Agents inherit the user session, meaning they act as “legitimate bots” — no more cat-and-mouse war with anti-bot defenses, as the interaction happens within an official framework supported by Chrome and Edge. Christian Moser predicts that platforms like Shopify, WooCommerce and Wix will integrate WebMCP as a “one-click” option.

Customer support and CRM

Agents can query ticket status, update customer records, and route support requests through existing web CRM systems — without fragile scraping. A support agent could call `createTicket(category, priority, description)` directly in the helpdesk web interface.

Healthcare and appointment booking

For medical, veterinary or dental practices, WebMCP would allow exposing booking and calendar management tools directly from the practitioner’s web interface. An agent could call `bookAppointment(practitioner, date, type)` reusing the frontend’s existing business logic.

Complex and specialized interfaces

The spec describes use cases for complex professional tools like code review platforms (Gerrit), graphic design tools, or ERPs — where agents can act as “smart shortcuts” that understand the interface better than a novice user.

Opportunities for early adopters

Immediate competitive advantage

Sites that implement WebMCP first will naturally be prioritized by AI agents: instead of resorting to uncertain scraping, agents will use sites that offer reliable interaction contracts. As one analyst puts it: “websites that make agent interaction deterministic will see massive adoption advantages.”

The two-layer web

Every website will now operate on two layers: a human layer (visual, branded, narrative — the CSS) and an agent layer (structured, schema-based, fast — the JSON Schema). Early adopters who build this duality now are getting ahead of a structural change in the web.

Reducing AI integration costs

For AI solution providers (OpenAI, Anthropic, Google), WebMCP eliminates the need to build costly sandboxed browsers to “mimic” humans, reducing their costs and increasing their agents’ reliability. This means businesses offering WebMCP-ready sites will benefit from smoother and less expensive integration with AI platforms.

Self-description at scale

WebMCP solves the “long-tail” integration problem for AI agents: by making sites self-descriptive, it potentially enables millions of agent-compatible services without custom integration. Agent behavior becomes deterministic at web scale.

Specific opportunities for SaaS and developers

  • Vertical SaaS platforms (healthcare, legal, real estate): expose business workflows as agent tools now
  • Extension/plugin developers: create WebMCP tools for popular CMS platforms (WordPress, Shopify)
  • Web agencies: offer “agent-readiness” audits and implementations as a new service
  • AI agent developers: prioritize WebMCP sites for reliability, use browser automation as fallback only

WebMCP vs MCP vs A2A: positioning

FeatureMCP (Anthropic)WebMCPA2A (Google)
LayerBackend (server)Frontend (browser)Agent-to-Agent
TransportJSON-RPC / HTTP+SSE / stdiopostMessage (in-browser)JSON-RPC / SSE
AuthOAuth 2.1, API keysInherited browser sessionAgent Cards
DevelopmentPython, Node.js, JavaFrontend JavaScriptMulti-language
Main use caseBackend tools and dataInteractive web UIInter-agent collaboration
Human-in-the-loopNot requiredCore design principleOptional
StatusAdopted standard, productionDevTrial, experimentalSpecification available

These three protocols are complementary and not competing: MCP for the backend, WebMCP for the browser, A2A for agent-to-agent communication.

How to get started today

Method 1: Chrome 146 native

1. Install Chrome 146 or higher (Chrome Beta or Canary) 2. Navigate to `chrome://flags` 3. Search for “Experimental Web Platform Features” 4. Enable the flag and relaunch Chrome 5. Install the Model Context Tool Inspector for debugging

Method 2: cross-browser polyfill

For immediate compatibility with all browsers, use the MCP-B polyfill:

```javascript import { initializeWebMCPPolyfill } from '@mcp-b/webmcp-polyfill';

// Automatically disables when native support is available initializeWebMCPPolyfill();

navigator.modelContext.registerTool({ name: 'greet', description: 'Say hello to a user by name', inputSchema: { type: 'object', properties: { name: { type: 'string' } }, required: ['name'] }, handler: async ({ name }) => ({ message: `Hello, ${name}!` }) }); ```

Method 3: React

The `usewebmcp` package provides native React hooks for tool registration.

```bash pnpm add usewebmcp ```

Limitations and precautions

WebMCP remains an experimental DevTrial — several important points must be considered before any significant investment:

  • Unstable API: method names, parameter shapes and the `navigator.modelContext` interface may change between Chrome versions.
  • Not production-ready: security issues (prompt injection, exfiltration through tool chaining, destructive operation enforcement) are identified but not fully resolved.
  • Limited discovery: tools only exist when a page is open in a tab — no mechanism like `.well-known/webmcp` for off-page discovery.
  • Multi-agent conflicts: when two agents operate on the same page, they can overwrite each other’s actions. A locking mechanism is proposed but not implemented.
  • 50 tools limit per page recommended to avoid overloading agents during discovery.
  • Browser support: Chrome only for now. Firefox, Safari and Edge participate in the W3C working group but have no implementation yet.

Conclusion: a pivotal moment for the web

WebMCP represents a paradigm shift comparable to the introduction of `robots.txt` for search engines, or REST APIs for mobile applications. For the first time, a web standard allows sites to “speak” natively to AI agents, providing them with a structured interaction contract rather than leaving them to guess from the DOM.

The fact that Google and Microsoft co-sign the specification gives a strong probability of cross-browser adoption in the medium term. The current moment — DevTrial, preview APIs, nascent ecosystem — is precisely the window of opportunity for early adopters: those who experiment now, who understand tool design patterns, and who build an “agent layer” on their web applications, will be best positioned when WebMCP becomes a stable and widely deployed standard.

References

    WebMCP: early adopters guide - Busony