BTradeTech · WebMCP
State of WebMCP 2026
A factual snapshot of the API surface, browser signals, implementation and security boundaries.
What is current in this snapshot
Chrome documentation describes imperative registration through document.modelContext.registerTool and declarative forms through toolname and tooldescription. The API is evolving, so examples need a reviewed date and should not be copied as permanent guarantees.
Security boundary
A browser agent should see a narrow, useful contract. Keep credentials and authorization server-side, label consequential actions, require human confirmation, and treat all tool input as untrusted.
Continue with the WebMCP workflow
Run a task simulation · Prioritise the next workflow · Create a reviewable scaffold · Review implementation evidence · Discuss production implementation