WebMCP
Turning WebMCP on in Chrome
Flags, the origin trial, and the difference between the two. Plus how to confirm your tools registered, rather than assuming they did because the code ran.
Last reviewed 27 August 2026
There are two separate ways WebMCP becomes available, and confusing them is the most common reason a developer concludes the API is broken.
Local development: the flag
For your own machine, enable the developer trial. Chrome 146 was the first stable release to carry it.
- Open
chrome://flags/#enable-webmcp-testing. - Set it to Enabled and restart the browser.
- Confirm in DevTools:
typeof document.modelContextshould reportobject.
The Experimental Web Platform Features flag also carries it in some builds. If the dedicated flag is missing from your version, that is the fallback worth trying before concluding your channel does not have it.
Real visitors: the origin trial
A flag only affects the browser it is set in. To have WebMCP work for people who visit your site, register the origin trial and serve the token. The trial covers Chrome 149 through 156.
<meta http-equiv="origin-trial" content="YOUR_TOKEN_HERE"> Origin-Trial: YOUR_TOKEN_HERE
An origin trial token has an end date, and when it passes the API silently disappears for your visitors while continuing to work perfectly on your machine, where the flag is still set. Put the expiry in the same calendar as your TLS certificates, and make your feature detection log rather than fail quietly.
Permissions policy
Access is gated behind a policy-controlled feature named tools, with a default allowlist of ['self']. Top-level documents and same-origin iframes get it automatically. A cross-origin iframe does not, and calling into it throws NotAllowedError.
<iframe src="https://widget.example.com/booking" allow="tools"></iframe>
That matters more than it first appears: booking widgets, chat, configurators and checkout steps are routinely third-party iframes, and those are exactly the surfaces you would most want an agent to operate.
Confirming registration actually happened
Code running is not the same as a tool being registered — a rejected name, a missing secure context or a thrown handler all fail without a visible symptom. Ask the browser directly.
const tools = await document.modelContext.getTools();
console.table(tools.map(t => ({
name: t.name,
description: t.description.slice(0, 60),
readOnly: t.annotations?.readOnlyHint ?? false,
})));getTools() is also how our own scanner will read a live tool list rather than inferring one from source, and it is the only way to see tools that a bundle registers at runtime.
Common reasons nothing appears
| Symptom | Usual cause |
|---|---|
document.modelContext is undefined | Flag not enabled, browser too old, or the page is not a secure context |
| Works locally, not in production | Origin trial token missing, expired, or issued for a different origin |
NotAllowedError | Cross-origin iframe without allow="tools" |
| Registration resolves, tool never listed | Name outside the permitted character set, or an AbortSignal already aborted |
| Tool listed, never called | Description too vague to choose from — see the imperative API |
| Worked last month, gone now | You were on navigator.modelContext; see migration |
The ChatGPT desktop app has consumed WebMCP since 25 August 2026, which makes it the most direct end-to-end test available: open your page in it and ask for the thing your tool does. A tool that a person can find in getTools() but an agent never calls has a description problem, not a registration problem.
Sources
Primary documents, checked on 27 August 2026
- developer.chrome.com/docs/ai/webmcp — Origin trial, flags, permissions policy directive
- webmachinelearning.github.io/webmcp — W3C Web Machine Learning Community Group draft — WebIDL, annotations, permissions policy
- developer.chrome.com/origintrials — Registering a trial and serving the token
- blog.cloudflare.com/webmcp — Chrome 146 experimental availability
- w3c.github.io/webappsec-permissions-policy — How the `tools` directive and allowlists behave
Keep reading
Check your own site against this
The Agent Readiness Score measures exactly what this article describes, and shows the evidence behind every finding.
Run the check →