WebMCP lets websites hand AI agents a menu of tools instead of a screen to guess at

Tools instead of guesswork

Many AI agents that work in a browser operate like a very patient human. They take a screenshot, guess where a button is, click it, and check whether anything happened. A small layout change can break the whole sequence.

WebMCP proposes a different approach. As dev.to reported in a post from the cloud platform Control Plane, the page itself publishes a list of "tools" for agents. Each tool is a JavaScript function with a description in natural language and a JSON Schema, which is a standard way of spelling out what inputs a function accepts.

The agent reads the list, picks a tool by its description, fills in the inputs, and the function runs inside the page. No guessing about what a button does.

A draft, not a standard

WebMCP is being developed in the W3C Web Machine Learning Community Group, and its editors are engineers from Microsoft and Google. It is published as a Draft Community Group Report. That is not the W3C standards track, so it should not be treated as a finished standard.

In the draft, a page registers a tool by calling document.modelContext.registerTool() with a name, a description and a function to run. Optional extras include a title, input and output schemas, and annotations describing how the tool behaves. A second approach based on ordinary HTML forms is being explored, though it is not yet part of the specification.

On browsers, Chrome's documentation says WebMCP is available behind a flag and through an origin trial starting in Chrome 149. Chrome also warns that it is subject to change.

How it differs from MCP

MCP servers are separate programs, running on your machine or a remote server, that offer tools to agents wherever those agents live: a terminal, an editor or a chat app. WebMCP works differently. It runs inside a web page, only while that page is open, and it borrows the page's current state and your signed-in session.

That means a site does not have to rebuild login and context on a separate backend just for agents. The source describes the two as complements, and says Chrome's own comparison recommends using both: MCP for persistence, WebMCP for the open tab.

What Control Plane is doing

Control Plane sells a platform for running apps and agents across clouds. Agents can already operate it through a hosted MCP server with over 100 tools, plus AI plugins for tools such as Claude Code. The console, its web interface, is the one remaining surface that browser agents cannot use in a structured way.

The company says it is adding WebMCP to the console in December 2026. Every action available there, including managing workloads, secrets, domains, logs, metrics and policies, would be offered to browser agents as a tool. Calls would go through the same Control Plane API, so existing policies and the audit trail would still apply.

Note the timing: this is a stated plan, and the product announcement is ahead of the actual release.

The security picture

The user and the agent share one browser session. By default, tools are visible only to the page that registered them and to frames from the same origin. Other frames need explicit permission, and Chrome notes that tools run visibly on the page, so you can watch what the agent does.

The draft also defines hints. One marks a tool as read-only. Another flags significant actions so an agent or browser can ask for confirmation first. A third marks results that may carry user-generated or outside content. That matters because something like a log file could contain text written to trick an agent, a risk known as prompt injection. The source's advice is that an agent should never follow instructions inside a result flagged as untrusted.

Control Plane points readers to Chrome's WebMCP security guidance. For newcomers, it suggests starting with the read-only profile of its MCP server, which has no tools that change anything.