WebMCP
Agent tools in the browser.
WebMCP is the in-browser counterpart to the hosted MCP server. Instead of a client connecting to an endpoint, a Cadensia page can publish structured tools directly to an in-browser agent — opt-in, confirmed, and audited.
An opt-in capability, not a public endpoint — there is nothing here for a visitor to connect to.
What is WebMCP?
Structured tools, not DOM scraping.
WebMCP is a proposed web standard, currently in a Chrome origin trial, that lets a page publish structured tools — with JSON schemas — to an agent running in the browser. The agent calls a declared tool instead of scraping and actuating the DOM.
It is designed as a progressive enhancement and is gated by the
tools permissions policy. The
spec is under active development, so API names and semantics may change.
How Cadensia ships it
On by default, opt-in for writes.
Enabled by default
A dependency-free in-browser runtime ships enabled for supported
surfaces via the webmcp_tools
flag. An operator can turn it off with the kill switch — with the flag
off, nothing registers.
Read-only by default
Read-only tools register with no prompt. Mutations do not register unless the surface explicitly opts in, so a mount with no opt-in can never expose a write.
Confirmation + CSRF
Every registered mutation asks the user first — inline for reversible writes and explicit for spend or transactional actions. A mutation that writes over the network also attaches the page's CSRF token, and one with no token is refused before it reaches the network.
Unchanged fallback
The runtime feature-detects browser support and the tools policy. When either is missing, or an operator has switched the flag off, the page is left exactly as it is today and remains fully usable.
The tools
10 tools, published to the page.
These are the tools the runtime registers when a surface opts in. Each acts as the signed-in user in the page's origin, and the confirmation level escalates with the effect.
| Tool | Kind | Confirmation | What it does |
|---|---|---|---|
| Read-only Registers by default; no confirmation. | |||
| get_generation_status | Read | None | Reports the status and progress of a generation batch for the signed-in account. Reads account data. |
| list_compiled_videos | Read | None | Lists a product's completed compiled videos for the signed-in account. Reads account data. |
| list_scheduled_posts | Read | None | Lists the account's scheduled posts, newest first, through the same-origin JSON projection. Reads account data. |
| Inline confirmation Reversible writes; the page surfaces the action before it runs. | |||
| import_product | Write | Inline | Imports a product from a URL into the signed-in account. Writes a record and fetches the external URL, confirmed inline. |
| export_video | Write | Inline | Produces a short-lived, signed-in download link for a compiled video the account owns. A safe GET, confirmed inline. |
| Explicit confirmation Spend or transactional; a distinct step the agent cannot skip. | |||
| start_generation | Transactional | Explicit | Starts ad generation for a product. Spends the account's allowance, so it needs an explicit confirmation and passes the same entitlement gate as the app. |
| begin_signup | Transactional | Explicit | Creates an account from an email address and password. Creates an identity, so it needs an explicit confirmation; the server's registration gate is surfaced honestly. |
| begin_checkout | Transactional | Explicit | Starts a subscription checkout for a plan. Charges payment, so it needs an explicit confirmation and a billing scope; plan and Stripe refusals are surfaced honestly. |
| one_time_checkout | Transactional | Explicit | Starts a one-time Stripe Checkout for an agent-purchasable SKU. Charges payment, so it needs an explicit confirmation and a billing scope; SKU and Stripe refusals are surfaced honestly. |
| schedule_post | Transactional | Explicit | Schedules a shoppable video from the Posting Studio form. It publishes later without a second prompt, so it needs an explicit confirmation and passes the same entitlement and availability guards as the UI. |
Security model
Acts as the user.
User session, no credential
Tools run in the page's origin with the user's session, so no credential is handed to the agent.
Confirmations carry weight
Because every tool acts as the user, non-read tools must confirm and spend or transactional actions must confirm explicitly.
No tenant identifiers
Account scoping is mandatory: no tool accepts a tenant identifier, and one is refused if supplied.
Every call audited
Every invocation is audited with the tool name, outcome, account, user, and request id.
WebMCP FAQ
Questions, answered.
What is WebMCP?
WebMCP is a proposed web standard, in a Chrome origin trial, that lets a page publish structured tools with JSON schemas to an in-browser agent instead of the agent scraping and actuating the DOM.
Is WebMCP a public endpoint I connect to?
No. It is an opt-in, in-browser capability. The runtime is dependency-free browser code that runs only when it is enabled for a surface and the browser supports WebMCP; there is no endpoint to connect to.
Which Cadensia tools register in the browser?
Ten are implemented. Three read with no prompt: get_generation_status, list_compiled_videos, and list_scheduled_posts. Two reversible writes confirm inline: import_product and export_video. Five spend or transactional actions confirm explicitly: start_generation (entitlement-gated), begin_signup, begin_checkout, one_time_checkout, and schedule_post (schedules a post that publishes later).
Do mutations run without asking me?
No. Read-only tools register by default; mutations register only on an explicit surface opt-in and require a user-visible confirmation — inline for reversible writes and explicit for spend or transactional actions.
What happens in a browser that does not support WebMCP?
Nothing changes. The runtime feature-detects support and the tools permissions policy; when either is missing, or the surface flag is off, the page is left exactly as it is today and remains fully usable.
How are WebMCP tools secured?
Tools run in the page's origin as the signed-in user, so confirmations carry the weight, no tool accepts a tenant identifier, and every invocation is audited.
Next
Want an agent in your own host?
WebMCP is for in-browser agents. To drive Cadensia from an external agent host, connect it to the hosted MCP server with a per-account token.
Questions about an integration? Contact the team