What's up with WebMCP?

You've probably seen the term WebMCP thrown around in AI circles recently. You could certainly be forgiven if you haven't been paying attention to what it is and what the benefits are. It could fundamentally change how we build the web and how humans use it.

To back up a bit, MCP is effectively a more natural language way of working with APIs. As a developer, you define tools (JSON objects) that describe your API using natural language and expose these tools in a standardized format. Unsurprisingly, WebMCP is no different, it's just uniquely client-side flavored. What's maybe the most interesting to me is how approachable WebMCP is.

Here's a simple example:

if (document.modelContext) {
  document.modelContext.registerTool({
    name: 'helloWorld',
    description: 'Say hello to my new friend.',
    parameters: { /* JSON schema */ },
    execute: async (args) => console.log('Hello World')
  });
}

That's it. That's the gig.

Here's what this manifests in a browser:

There's also a proposal for a declarative API:

<form toolname="create_page"
      tooldescription="Create a new page in the current folder from a template."
      action="/api/pages" method="post">
  <label for="title">Title</label>
  <input id="title" name="title" required>

  <label for="slug">URL slug</label>
  <input id="slug" name="slug" pattern="[a-z0-9-]+"
         toolparamdescription="Lowercase letters, numbers, and hyphens. Becomes the last segment of the page URL.">

  <label for="template">Template</label>
  <select id="template" name="template" required>
    <option value="article">Blog article</option>
    <option value="landing">Landing page</option>
    <option value="blank">Blank page</option>
  </select>

  <button type="submit">Create</button>
</form>

Even for marketing focused sites, you can imagine a world where you ask your agent, "Can you give them my contact information? I'd like to learn more." and your agent can find declarative WebMCP forms and fill them out with the information it already has. No more random fields dropping out from your autofill because a developer used zip instead of postal-code.

Here are the unlocks I see:

1. You don't need to own the chat experience - security, iframing, streaming responses, all that crap is owned by the browser (or an extension today).

2. You don't need to own the model - Much like operating systems, models are becoming a preference people land on. Someone's corporate laptop may be on MAI (Microsoft's new frontier play) for compliance reasons, but they may like Claude on their personal devices.

3. No more DOM scraping - Nearly every agent extension today relies on scraping a website's DOM to achieve a particular goal. To say this is error prone would be an understatement.

4. It's stupid simple to implement - The fact that any front-end developer can create a tool in a few seconds should create a proliferation of amazing opportunities.

5. Tool outcomes can be visual - Let's say you have a list of items in your UI, with WebMCP, you can expose a tool that selects those items. The human will visually see what is happening as it happens.

The subtext here is that our industry has a path to get out of what I call, "Clippy hell." Every SaaS company in the world raced to bolt a shitty chatbot onto their existing UIs and we've all had to pay the price.

As a user, I don't want your shitty chatbot. I want my model, my security, and a browser native UI. Similarly, a lot of us have found ourselves going to our LLM caves (i.e. claude.ai/new) because that's where MCPs currently live and that's where all our context lives. If all of this can be brought to the actual UIs we want to use without developers having to build entire chat experiences, we might just be on to something.

About security

It's maybe worth calling out that WebMCP doesn't inherently fix some of the structural challenges in working with agents. Prompt injection is still a very real concern. Misleading tools, auth, what tools can be automatic, etc. are all areas for concern. What I do like about WebMCP is that my conversations stay with me, my browser, and my preferred agent. A site might record the outcome, but it doesn't (and can't) know how I got there.

What's next for WebMCP?

As of today, you can enable the WebMCP feature flag on Chromium based browsers and you can use an extension to try everything out end to end. Google is also in the middle of an origin trial that anyone can sign up for. The hope is that by early to mid 2027, document.modelContext is enabled by default. By mid to late 2027, Chrome and Edge hopefully should have an agent pane that can call the tools sites expose.

The elephants in the room

At the time of this writing, Mozilla has taken a neutral, if somewhat positive stance on WebMCP. As mostly expected, WebKit has taken a skeptical position.

This isn't necessarily a death sentence, but it does mean broad adoption has some challenges moving forward. WebKit notoriously doesn't tend to adopt major new standard proposals unless there's a clear and immediate benefit to Apple itself.

What should web applications do today?

If I was building a web application today, I would embrace the spirit of WebMCP, even if I wasn't adopting it directly. Rationalizing what client-side tools you want to expose to agents is a good exercise to walk through even if WebMCP never lands. If you find that you want to own an entire chat experience, you've already done a lot of the plumbing that your own chatbot can talk to.

References

1. WebMCP Explainer - Why it exists, what it’s trying to accomplish.

2. WebMCP Extension - If you want to test things yourself, you'll need to use an extension. Additional notes:

   1. This runs a web server and requires an API key from a model provider.

   2. You'll need to turn on chrome://flags/#enable-webmcp-testing for discovery.

3. WebMCP Imperative API - Declare tools using JavaScript.

4. WebMCP Declarative API - Declare tools using HTML.