WebMCP
Capability · W3C Web Machine Learning CG · Updated 2026-07-19
Status: W3C Community Group draft (not on the standards track); Chrome origin trial since Chrome 149 (June 2026), Edge opt-in trial · Authoritative source
MCP’s in-browser sibling: a page registers its functionality as schema-described tools via a browser API, so user-in-the-loop agents can act through the user’s own session — no separate server, no separate auth.
The draft defines a single surface: document.modelContext, where a page registers tools that browser-hosted agents can call (Chrome deprecated the earlier navigator.modelContext name in Chrome 150). The security model is the browser’s own: same-origin rules and the user’s existing session — an agent can only do what the user could do on that page.
Status precisely: a Community Group draft, which is not a W3C standard nor on the standards track. Chrome opened an origin trial in Chrome 149 (June 2026); Microsoft Edge runs its own opt-in origin trial. Nothing ships by default. The /.well-known/webmcp.json manifest that AgentGrade also checks is a community convention for out-of-page discovery — the draft itself defines only the in-page API.
Registering a tool in-page
document.modelContext.registerTool({
name: "search_products",
description: "Search the catalog",
inputSchema: { type: "object",
properties: { q: { type: "string" } } },
async execute({ q }) { /* … */ }
});How AgentGrade checks it
The scanner checks for the optional /.well-known/webmcp.json manifest and homepage tool annotations — informational checks (no score penalty) while the spec is pre-standard, consistent with our emerging-protocol policy. Scan your site to see where you stand.
Related
All standards
RFC 9421 · Web Bot Auth · RFC 8615 · MCP · A2A · x402 · WebMCP · llms.txt · RFC 9309 · RFC 9110 · Index