webmcp-tool

WebMCP

Turning WebMCP on in Chrome

Flags, the origin trial, and the difference between the two. Plus how to confirm your tools registered, rather than assuming they did because the code ran.

Last reviewed 27 August 2026

There are two separate ways WebMCP becomes available, and confusing them is the most common reason a developer concludes the API is broken.

Local development: the flag

For your own machine, enable the developer trial. Chrome 146 was the first stable release to carry it.

  1. Open chrome://flags/#enable-webmcp-testing.
  2. Set it to Enabled and restart the browser.
  3. Confirm in DevTools: typeof document.modelContext should report object.

The Experimental Web Platform Features flag also carries it in some builds. If the dedicated flag is missing from your version, that is the fallback worth trying before concluding your channel does not have it.

Real visitors: the origin trial

A flag only affects the browser it is set in. To have WebMCP work for people who visit your site, register the origin trial and serve the token. The trial covers Chrome 149 through 156.

<meta http-equiv="origin-trial" content="YOUR_TOKEN_HERE">

Origin-Trial: YOUR_TOKEN_HERE
Either meta tag or response header — the header is easier to keep current
Trials expire

An origin trial token has an end date, and when it passes the API silently disappears for your visitors while continuing to work perfectly on your machine, where the flag is still set. Put the expiry in the same calendar as your TLS certificates, and make your feature detection log rather than fail quietly.

Permissions policy

Access is gated behind a policy-controlled feature named tools, with a default allowlist of ['self']. Top-level documents and same-origin iframes get it automatically. A cross-origin iframe does not, and calling into it throws NotAllowedError.

<iframe src="https://widget.example.com/booking" allow="tools"></iframe>

That matters more than it first appears: booking widgets, chat, configurators and checkout steps are routinely third-party iframes, and those are exactly the surfaces you would most want an agent to operate.

Confirming registration actually happened

Code running is not the same as a tool being registered — a rejected name, a missing secure context or a thrown handler all fail without a visible symptom. Ask the browser directly.

const tools = await document.modelContext.getTools();
console.table(tools.map(t => ({
  name: t.name,
  description: t.description.slice(0, 60),
  readOnly: t.annotations?.readOnlyHint ?? false,
})));
Paste into the DevTools console on your own page

getTools() is also how our own scanner will read a live tool list rather than inferring one from source, and it is the only way to see tools that a bundle registers at runtime.

Common reasons nothing appears

SymptomUsual cause
document.modelContext is undefinedFlag not enabled, browser too old, or the page is not a secure context
Works locally, not in productionOrigin trial token missing, expired, or issued for a different origin
NotAllowedErrorCross-origin iframe without allow="tools"
Registration resolves, tool never listedName outside the permitted character set, or an AbortSignal already aborted
Tool listed, never calledDescription too vague to choose from — see the imperative API
Worked last month, gone nowYou were on navigator.modelContext; see migration
Testing with a real agent

The ChatGPT desktop app has consumed WebMCP since 25 August 2026, which makes it the most direct end-to-end test available: open your page in it and ask for the thing your tool does. A tool that a person can find in getTools() but an agent never calls has a description problem, not a registration problem.

Sources

Primary documents, checked on 27 August 2026

  1. developer.chrome.com/docs/ai/webmcpOrigin trial, flags, permissions policy directive
  2. webmachinelearning.github.io/webmcpW3C Web Machine Learning Community Group draft — WebIDL, annotations, permissions policy
  3. developer.chrome.com/origintrialsRegistering a trial and serving the token
  4. blog.cloudflare.com/webmcpChrome 146 experimental availability
  5. w3c.github.io/webappsec-permissions-policyHow the `tools` directive and allowlists behave

Keep reading

Check your own site against this

The Agent Readiness Score measures exactly what this article describes, and shows the evidence behind every finding.

Run the check →