WebMCP
A proposed web standard aimed at preparing websites for the AI agent era. It extends the MCP protocol and was systematically presented by Google engineers at a Google I/O Connect workshop.
Core Facts
WebMCP is an extension of MCP in web scenarios, allowing websites to declare within their pages the callable tools they expose and their schemas.
AI代理操控计算机面临的安全风险包括提示注入攻击、权限升级和不可逆操作等问题
The biggest security risk of allowing AI to directly invoke web capabilities is security itself; WebMCP-type protocols must have built-in permission authorization models, user confirmation mechanisms before critical operations, and tool source trustworthiness verification.
Timeline (last 90 days)
WebMCP registers tools into the page context via window.navigator.modelContext.registerTool(), so any visiting AI agent can discover and execute them without first scraping the DOM and then reasoning.
The cost of WebMCP is that sites need to actively maintain tool signatures and remain backward compatible when versions update; declaring capabilities in the DOM is becoming infrastructure as important for AI-readable websites as SEO is today.
WebMCP does not bypass the security mechanisms of existing applications; users still log into the same application using the same session, and the original permissions and authorization controls remain in effect
A limitation of WebMCP is that the application must be open in the user's browser for the relevant tools to be available, making it inherently bound to the web application
WebMCP does not have an independent client and server architecture and operates on the client side (within a specific web application in the browser)
WebMCP exposes the data collection, transformation, and validation logic already present in the frontend of legacy web applications as structured tools, requiring only minimal changes to existing applications
The video author considers WebMCP still an experimental approach that is not suitable for all scenarios and needs to be evaluated case by case based on requirements and constraints
In the demo, WebMCP is added to each of the three legacy systems — CRM, credit risk, and loan origination — exposing only the capabilities the Agent needs (retrieving customer details, running credit checks, and updating loan applications)
WebMCP enables AI Agents to directly drive existing enterprise applications without rebuilding the backend
Shopify has launched the WebMCP tool, providing AI agents with a machine-readable shopping entry point.
29 more timeline events
All Facts (20)
WebMCP is an extension of MCP in web scenarios, allowing websites to declare within their pages the callable tools they expose and their schemas.
75%VerifiedAI代理操控计算机面临的安全风险包括提示注入攻击、权限升级和不可逆操作等问题
70%VerifiedThe biggest security risk of allowing AI to directly invoke web capabilities is security itself; WebMCP-type protocols must have built-in permission authorization models, user confirmation mechanisms before critical operations, and tool source trustworthiness verification.
65%VerifiedWebMCP (Web Model Context Protocol) is a next-generation Web standard proposed to address the pain points of AI agents operating web pages.
65%UnverifiedThe cost of WebMCP is that sites need to actively maintain tool signatures and remain backward compatible when versions update; declaring capabilities in the DOM is becoming infrastructure as important for AI-readable websites as SEO is today.
50%UnverifiedWebMCP registers tools into the page context via window.navigator.modelContext.registerTool(), so any visiting AI agent can discover and execute them without first scraping the DOM and then reasoning.
50%UnverifiedWebMCP does not bypass the security mechanisms of existing applications; users still log into the same application using the same session, and the original permissions and authorization controls remain in effect
50%UnverifiedWebMCP exposes the data collection, transformation, and validation logic already present in the frontend of legacy web applications as structured tools, requiring only minimal changes to existing applications
50%UnverifiedWebMCP enables AI Agents to directly drive existing enterprise applications without rebuilding the backend
50%UnverifiedWebMCP does not have an independent client and server architecture and operates on the client side (within a specific web application in the browser)
50%UnverifiedA limitation of WebMCP is that the application must be open in the user's browser for the relevant tools to be available, making it inherently bound to the web application
50%UnverifiedThe video author considers WebMCP still an experimental approach that is not suitable for all scenarios and needs to be evaluated case by case based on requirements and constraints
50%UnverifiedWebMCP is a protocol for standardized communication between AI agents in browsers and web services, driven primarily by Anthropic.
50%UnverifiedThe WebMCP proposal is currently led by Google and is in the Origin Trial stage, and has not yet become a formal W3C standard.
50%UnverifiedThe WebMCP declarative API requires users to manually click the submit button by default; if automatic submission upon completion is desired, the autosubmit attribute can be used.
50%UnverifiedRecommendations for tool evaluation: use deterministic testing as much as possible for what can be deterministically tested, and then use LLM to evaluate touchpoints with agents.
50%UnverifiedWebMCP uniformly uses JSON-LD format for communication.
50%UnverifiedWebMCP's declarative API allows the browser to automatically parse forms into tools by adding specific attributes to HTML form tags.
50%UnverifiedWebMCP is best suited for three types of scenarios: legacy systems with an immutable backend, applications with business logic tightly bound to the frontend, and tasks that are heavily dependent on account permissions.
50%UnverifiedWebMCP development best practices include semantics-first design, single responsibility, timely state updates, friendly error handling, dynamic tool registration, and thorough testing (using Eval).
50%