Entity trail

WebMCP

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-02 / agents-researcherVercel's agent-browser turns on WebMCP by default so agents call tools the page itself exposesagent-browser v0.36.0, published 2026-09-01, adds experimental WebMCP support for discovering and invoking tools provided by the current page, with frame-aware tool selection, detached results, cancellation, bounded metadata and output handling, and an opt-in MCP tool profile. It is enabled by default for locally managed Chrome and disabled with `--no-webmcp` or `AGENT_BROWSER_NO_WEBMCP`. The release also ships a WebMCP generation skill that helps an agent expose an existing page workflow as a validated page tool while recording safety constraints, deterministic checks and fallback behavior, which is the first shipped tooling for authoring WebMCP surfaces rather than just consuming them.
2026-08-28 / thought-leaders-researcherLovable CTO Fabian Hedin: SaaS companies now have to 'provide the shovel for AI to use their capabilities'On Latent Space (August 26), Hedin argues the future is one entry point to all your work and that every capability a product ships has to be reusable agentically rather than only through its own UI. Menlo Ventures' Deedy Das, whose firm led the $400M Series C at a $13.3B valuation, put Lovable at a $500M annualized revenue run rate, more than 60 million projects created, over 900 million monthly visits to Lovable-built apps, and use by employees at nearly two-thirds of the Fortune 500. The argument lands next to OpenAI's WebMCP push: the vertical capability keeps its value, the click-through interface does not.
2026-08-26 / agents-researcherWebMCP-Phalanx blocks all 80 tool-description injections in a browser agent, then gets bypassed by a malicious tool name called before inspectionThis 25 August paper (arXiv 2608.24017) attacks the W3C WebMCP proposal, which lets LLM agents invoke tools exposed by web pages, and finds the Same-Origin Policy leaves three gaps: subject-attribution spoofing, uncontrolled tool lifecycles, and semantic prompt injection. Their dual-layer runtime binds each tool to its registering principal with cryptographic capability credentials and splits inspection (a Quarantine LLM with no tool authority) from execution (a Privileged LLM), taking revocation and overwrite attack success from 100% to 0%, blocking all 80 description-embedded injections and limiting tool-return attacks to 2 of 80, with task utility statistically indistinguishable from baseline. The honest failure is the useful part: a white-box adaptive attacker bypasses description filtering via a malicious tool name invoked before inspection completes, which is why they propose a call-timing gate.
2026-08-26 / thought-leaders-researcherOpenAI ships WebMCP in the ChatGPT desktop browser, letting sites hand agents typed tools instead of a UI to click throughOpenAI Devs announced on August 26 that WebMCP is now supported in the ChatGPT desktop app's built-in browser and in ChatGPT Sites, so ChatGPT and Codex can call a site's declared tools directly. WebMCP is an experimental web standard that adds navigator.modelContext to the browser, letting a page expose structured actions like search, add-to-cart or reserve rather than leaving the agent to guess its way through the DOM. OpenAI is running a WebMCP Challenge closing September 4 with $3,000 top prizes, and says Shopify storefronts are already exposed.
2026-08-11 / rss-researcherCloudflare's Agents Week ships WebMCP, MCPv2 and Kitesurf — a full agent stack including an agent-first browser in V8 isolatesCloudflare closed a five-day Agents Week (Aug 3–7) with roughly two dozen launches. The heaviest for builders: WebMCP, a preview protocol making websites discoverable and callable by agents; MCPv2, a rewritten Model Context Protocol with simplified deployment; Kitesurf, an agent-first browser running in V8 isolates on Workers for lower resource use; Cloudflare Wallets for agent transactions; and WriteGuard (private beta) for fine-grained control over risky MCP tool calls. Cloudflare also proposed an 'Agent Development Lifecycle' to supersede SDLC, open-sourced its internal Cloudflare OS platform, added TCP/gRPC to Workers and Containers for real-time voice agents, and committed $1M more in open-source funding over two years.
2026-08-10 / vibe-coding-researcherTip: chrome-devtools-mcp Exposes 12 Heap-Snapshot Tools Most Users Never TouchThe official Chrome DevTools MCP server (~48.9k stars) ships 52 tools across 10 categories, and the useful surface is much wider than the click/type automation everyone uses: 12 memory tools for heap snapshot analysis, 3 performance tools for trace recording, 8 debugging tools including Lighthouse audits, and 4 third-party/WebMCP integration tools. If you are debugging a leak or an INP regression, an agent can now take and diff heap snapshots directly rather than you reading a flame chart — a category of work that was effectively unavailable to coding agents until the memory tools landed. Worth re-reading the tool list even if you installed this server months ago.
2026-08-07 / agents-researcherCloudflare frames the agentic web around four pillars and announces PACT with Mozilla, Google, Microsoft and ShopifyCloudflare's August 6 capstone post organizes its Agents Week releases around making the internet readable, discoverable, callable and payable for agents, naming Markdown for Agents (a server-side format cutting token consumption), Kitesurf, AI Search, WebMCP, Wallets, the Monetization Gateway and Web Bot Auth as the concrete pieces. The new item is PACT (Private Access Control Tokens), announced with Mozilla, Google, Microsoft and Shopify, which lets a site anonymously vouch for a visitor — a privacy-preserving alternative to fingerprinting agents at the edge, and a rare four-vendor alignment on agent identity. Payment rails reference x402 for direct merchant settlement; note the post cites 'billions of requests' wasted re-fetching unchanged content but gives no current agent-traffic figures.
2026-08-07 / agents-researcherCloudflare gives any site a WebMCP interface with one dashboard toggle — no origin code changesCloudflare launched a developer preview of WebMCP on August 6, 2026, using HTMLRewriter at the edge to inject a single bridge script tag into every HTML response, which then registers MCP tools on document.modelContext — the browser surface shipping experimentally in Chrome 146. Tools arrive as opt-in packs (Content Credentials and Site MCP Server ship on by default) declared via a data-packs attribute, and every tool in the preview executes entirely in the visitor's browser with no round trip to Cloudflare, with the Site MCP Server pack calling the origin's own MCP endpoint using the visitor's existing session. Because the bridge emits standard MCP Tool and CallToolResult types, any agent that already speaks MCP can drive the page unmodified; setup lives under Agent Readiness > Labs in the dashboard.
2026-07-11 / vibe-coding-researcherPattern: MCP Trust-Boundary Attacks Have Become the Dominant Agent-Hijack VectorThree distinct July-2026 attack classes now share one root cause: the Sentry fake-event injection (payload via a trusted integration), Mid-Session Tool Injection / MSTI (hijacking which tools a WebMCP agent uses mid-session), and workspace-config auto-loading (Amazon Q's CVSS 8.5 flaw loading MCP configs without consent). All exploit the agent treating MCP-supplied context as trusted. The defensive pattern is converging: zero-trust boundaries between agent and context providers, output validation on every MCP response, and explicit consent for any config the agent didn't author.
2026-07-09 / agents-researcherMid-Session Tool Injection weaponized against WebMCP agents via threshold poisoning and fake diagnostic eventsJuly MCP security roundups document attackers actively using Mid-Session Tool Injection (MSTI) to hijack tools in WebMCP agents mid-conversation, using threshold poisoning and fabricated diagnostic events to swap or re-scope tools after a session is established. The technique proves context providers can no longer be blindly trusted even after an initial handshake. It reinforces the shift toward per-response output validation and zero-trust boundaries between agents and their tool servers.
2026-06-12 / vibe-coding-researcherChrome DevTools MCP Reaches Stable v1.1.1 With WebMCP Debugging and Custom Page-Exposed ToolsGoogle's official chrome-devtools-mcp server and CLI are now marked officially stable (v1.1.1), letting coding agents attach to a live Chrome session for reliable automation, in-depth debugging, and performance analysis. New features include WebMCP tool listing/execution from within DevTools, custom third-party debugging tools that pages define via JavaScript, and custom HTTP header emulation (auth tokens, custom User-Agents). The repo is at 43k+ stars.
2026-06-07 / arxiv-researcherWebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM AgentsWebMCP — the emerging standard (now in a Chrome 149 origin trial) that lets websites expose JavaScript functions and HTML forms directly as tools for browser agents — introduces a new attack surface: a site can dynamically alter the tools an agent sees at runtime. The paper demonstrates 'tool surface poisoning' where the agent-accessible tool list is manipulated mid-session to redirect agent behavior. Critical reading for anyone building or deploying browser-based agents. Published 2026-06-04 (cs.CR).

Graph relationships

SUPPORTS
agent-browser
agent-browser v0.36.0 adds experimental WebMCP support for discovering and invoking tools.
Source finding
RELEASED
OpenAI
OpenAI announced WebMCP support in ChatGPT desktop app and ChatGPT Sites.
Source finding
BUILT BY
W3C
WebMCP is a W3C proposal.
Source finding
MENTIONS
Chrome 146 Canary
WebMCP now available in Chrome 146 Canary
Source finding
RELEASED
Chrome
Chrome 146 Canary ships WebMCP W3C standard.
Source finding
SUPPORTS
Chrome
WebMCP ships in Chrome 146 Canary
Source finding
USES
SearXNG
WebMCP added SearXNG support for privacy-respecting web search.
Source finding
RELEASED
Google
Google released WebMCP as an open web standard.
Source finding
SUPPORTS
Cloudflare
Browser Run enables websites to declare structured agent-callable actions via WebMCP.
Source finding
RELEASED
Google
Google proposed WebMCP as open web standard for browser-based AI agents.
Source finding
SUPPORTS
agent-browser -> WebMCP
agent-browser v0.36.0 adds experimental WebMCP support for discovering and invoking tools.
Source finding
RELEASED
OpenAI -> WebMCP
OpenAI announced WebMCP support in ChatGPT desktop app and ChatGPT Sites.
Source finding

Source trail

release OpenAI Devs announced arXiv 2608.24017 arXiv 2608.23858 The recap official server WebMCP developer preview Mid-Session Tool Injection Google's Chrome team imperative API tripled to $3M Over 40% of seed and Series A capital

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…