WebMCP Assurance

WebMCP Assurance — risks and 14 security controls

WebMCP is an emerging browser protocol that lets a web page expose tools an AI agent can call directly, through registerTool or declarative form attributes. If a tool's annotation does not match what it actually does, an agent can trigger a durable change believing it is read-only, send data to an unexpected origin or skip a confirmation step. LyraShield checks 14 published controls against your source, in your browser.

Open the free WebMCP Security Checker Start free trial

This page exposes 1 read tool. The Security Lab exposes 2 read tools. The dashboard exposes 2 read tools and 1 prepared-mutation tool; it never acts without your click.

What is WebMCP?

WebMCP is an emerging browser protocol that lets a web page expose JavaScript functions or declarative form tools to an AI agent. The page can register a tool with document.modelContext.registerTool() or mark up a form with toolname, tooldescription and toolautosubmit. When the protocol is available, the agent can discover and call those tools directly from the page.

This is different from a coding-agent MCP server. WebMCP is scoped to the current browser origin and the tools the page chooses to register. It is also experimental: support, behavior and security boundaries may change as the protocol evolves.

Why WebMCP tools need review

A browser tool can read data, trigger UI changes or start network requests. If the tool annotations do not match the implementation, an agent may call a durable mutation thinking it is read-only, send data to an unexpected origin or skip a confirmation step. Because the tools are exposed to the page origin, misconfigured headers or cross-origin iframes can widen that surface.

LyraShield's approach is to treat WebMCP as part of the release surface: discover the registered tools, check their behavior against the 14 controls, prepare a bounded diff and rerun the check before applying anything. No tool is automatically trusted just because it has a clean schema.

The 14 WebMCP controls

Machine-readable registry

Each control has a stable ID, severity and evidence state. A result is a signal for review, not a claim that the condition is exploitable. The registry is versioned as webmcp-assurance/2.

Control ID	What it catches	What to do
WEBMCP-05CRITICAL	A tool performs a durable, resource-consuming or otherwise destructive mutation without a visible human confirmation step.	Add a visible confirmation step before any durable mutation. For declarative forms, omit toolautosubmit and require the user to click Submit.
WEBMCP-01HIGH	A tool claims to be read-only or safe but its implementation performs mutation, network calls or handles untrusted content inconsistently with its annotations.	Align the tool's annotations with its behavior. Add untrustedContentHint for externally sourced output and remove readOnlyHint when the tool mutates state.
WEBMCP-03HIGH	A tool is exposed to an untrusted origin, a wildcard or a value that cannot be resolved at analysis time.	Scope exposedTo to the minimum required origins. Replace dynamic or wildcard exposure with an explicit allowlist.
WEBMCP-04HIGH	The site or config exposes tools broadly through Permissions-Policy: tools=*, Origin-Agent-Cluster: ?0, document.domain manipulation or delegated cross-origin iframes.	Add Origin-Agent-Cluster: ?1, keep Permissions-Policy tools=(self), remove document.domain assignments and avoid cross-origin tool delegation.
WEBMCP-09HIGH	A tool accepts structured input without a closed schema, type checks or a validation library at the trust boundary.	Define a strict JSON Schema, set additionalProperties: false for object inputs and add runtime validation before using tool input.
WEBMCP-11HIGH	A tool's name, title, description or input schema embeds a credential, API key, token or connection string, disclosing it to the model and to anyone who can read the tool surface.	Remove the credential from the tool definition. Read it from a server-side secret store at execution time, never embed it where the model or a reader can see it.
WEBMCP-12HIGH	A tool's description or schema carries instruction-shaped text aimed at the consuming model (e.g. 'ignore previous instructions', 'you must always'), turning the tool surface into a prompt-injection vector.	Rewrite the tool contract to describe behavior, not to instruct the model. Remove imperative text aimed at the consuming agent.
WEBMCP-02MEDIUM	A tool fetches or returns content from an external origin, user or unvalidated source but does not set untrustedContentHint.	Set untrustedContentHint for tools whose output is sourced from or influenced by external content.
WEBMCP-06MEDIUM	A tool accepts or returns unbounded, sensitive or poorly described data without limits or closed schema constraints.	Add maxLength, maxItems, additionalProperties: false and clear descriptions. Bound output arrays and mark sensitive parameters.
WEBMCP-07MEDIUM	A tool starts a network request but does not pass the AbortSignal through to fetch, leaving in-flight requests after the caller cancels.	Forward { signal } into every fetch call inside the tool's execute body and handle the resulting AbortError.
WEBMCP-08MEDIUM	A tool is registered inside a component or effect without a corresponding cleanup that unregisters it when the context is destroyed.	Store the registration handle and unregister it in the component or effect cleanup path.
WEBMCP-10MEDIUM	Two or more tools share a name, have misleading titles or descriptions or overlap so much that an agent cannot choose safely.	Rename, merge or clarify duplicate tools so each has a unique name and a distinct, honest description.
WEBMCP-13MEDIUM	Source uses a legacy WebMCP API, a non-standard annotation or places registration-only exposedTo or signal options inside the tool definition.	Use document.modelContext, remove retired APIs and non-standard annotations and pass exposedTo or signal in registerTool's options argument.
WEBMCP-14MEDIUM	A tool or parameter name, description or identifier exceeds the WebMCP syntax or Chrome guidance budget.	Use a concise permitted identifier, keep names within 30 characters, tool descriptions within 500 characters and parameter descriptions within 150 characters.

Control detail

The full definition of each control, including the negative evidence that closes it and the false-positive notes that bound it.

WEBMCP-05 · Durable/resource-consuming mutation lacks visible confirmation boundary

CRITICAL

A tool performs a durable, resource-consuming or otherwise destructive mutation without a visible human confirmation step.

Negative evidence: Every mutation tool in supported files shows an explicit confirmation prompt or is prepared for the user to review before submission.

What to do: Add a visible confirmation step before any durable mutation. For declarative forms, omit toolautosubmit and require the user to click Submit.

WEBMCP-01 · WebMCP annotation/behavior mismatch

HIGH

A tool claims to be read-only or safe but its implementation performs mutation, network calls or handles untrusted content inconsistently with its annotations.

Negative evidence: Every tool's readOnlyHint, untrustedContentHint and behavior classification are consistent with its execute body and schema.

What to do: Align the tool's annotations with its behavior. Add untrustedContentHint for externally sourced output and remove readOnlyHint when the tool mutates state.

WEBMCP-03 · Unsafe or dynamic cross-origin tool exposure

HIGH

A tool is exposed to an untrusted origin, a wildcard or a value that cannot be resolved at analysis time.

Negative evidence: Every exposedTo value is a precise same-origin or explicitly trusted origin list and is not dynamic.

What to do: Scope exposedTo to the minimum required origins. Replace dynamic or wildcard exposure with an explicit allowlist.

WEBMCP-04 · Explicitly unsafe tool permissions or disabled origin isolation

HIGH

The site or config exposes tools broadly through Permissions-Policy: tools=*, Origin-Agent-Cluster: ?0, document.domain manipulation or delegated cross-origin iframes.

Negative evidence: No Permissions-Policy wildcard, no OAC ?0, no document.domain assignment and no delegated tool iframe is present in assessed source.

What to do: Add Origin-Agent-Cluster: ?1, keep Permissions-Policy tools=(self), remove document.domain assignments and avoid cross-origin tool delegation.

WEBMCP-09 · Weak schema or missing runtime validation at a trust boundary

HIGH

A tool accepts structured input without a closed schema, type checks or a validation library at the trust boundary.

Negative evidence: Every supported tool has a closed object schema and uses explicit runtime validation before acting on input.

What to do: Define a strict JSON Schema, set additionalProperties: false for object inputs and add runtime validation before using tool input.

WEBMCP-11 · Credential or secret embedded in a tool definition

HIGH

A tool's name, title, description or input schema embeds a credential, API key, token or connection string, disclosing it to the model and to anyone who can read the tool surface.

Negative evidence: No tool name, title, description or schema field contains a credential-shaped value.

What to do: Remove the credential from the tool definition. Read it from a server-side secret store at execution time, never embed it where the model or a reader can see it.

WEBMCP-12 · Prompt-injection surface in a tool contract

HIGH

A tool's description or schema carries instruction-shaped text aimed at the consuming model (e.g. 'ignore previous instructions', 'you must always'), turning the tool surface into a prompt-injection vector.

Negative evidence: Tool descriptions and schemas describe the tool's behavior and parameters without instructing the consuming model.

What to do: Rewrite the tool contract to describe behavior, not to instruct the model. Remove imperative text aimed at the consuming agent.

WEBMCP-02 · Externally influenced output lacks untrusted content hint

MEDIUM

A tool fetches or returns content from an external origin, user or unvalidated source but does not set untrustedContentHint.

Negative evidence: Every tool that returns external, user-generated or otherwise unvalidated content sets untrustedContentHint.

What to do: Set untrustedContentHint for tools whose output is sourced from or influenced by external content.

WEBMCP-06 · Sensitive or unbounded input/output contract

MEDIUM

A tool accepts or returns unbounded, sensitive or poorly described data without limits or closed schema constraints.

Negative evidence: Every supported tool schema has bounded string/array lengths, closed object schemas with additionalProperties: false where safe and descriptions for sensitive fields.

What to do: Add maxLength, maxItems, additionalProperties: false and clear descriptions. Bound output arrays and mark sensitive parameters.

WEBMCP-07 · Network operation does not forward cancellation

MEDIUM

A tool starts a network request but does not pass the AbortSignal through to fetch, leaving in-flight requests after the caller cancels.

Negative evidence: Every supported network call forwards the tool's AbortSignal to the underlying fetch or request.

What to do: Forward { signal } into every fetch call inside the tool's execute body and handle the resulting AbortError.

WEBMCP-08 · Component registration lacks lifecycle cleanup

MEDIUM

A tool is registered inside a component or effect without a corresponding cleanup that unregisters it when the context is destroyed.

Negative evidence: Every supported registration returns or uses an AbortController/abort handler that unregisters the tool on cleanup.

What to do: Store the registration handle and unregister it in the component or effect cleanup path.

WEBMCP-10 · Duplicate, overlapping, ambiguous or misleading tool contract

MEDIUM

Two or more tools share a name, have misleading titles or descriptions or overlap so much that an agent cannot choose safely.

Negative evidence: Every tool has a unique name, a clear title and description and a distinct purpose.

What to do: Rename, merge or clarify duplicate tools so each has a unique name and a distinct, honest description.

WEBMCP-13 · Spec drift or misplaced WebMCP registration option

MEDIUM

Source uses a legacy WebMCP API, a non-standard annotation or places registration-only exposedTo or signal options inside the tool definition.

Negative evidence: Source uses document.modelContext and current registration options, with only readOnlyHint and untrustedContentHint annotations.

What to do: Use document.modelContext, remove retired APIs and non-standard annotations and pass exposedTo or signal in registerTool's options argument.

WEBMCP-14 · Tool contract exceeds browser guidance

MEDIUM

A tool or parameter name, description or identifier exceeds the WebMCP syntax or Chrome guidance budget.

Negative evidence: Tool and parameter names use the permitted characters and stay within 30 characters; descriptions stay within Chrome's published budgets.

What to do: Use a concise permitted identifier, keep names within 30 characters, tool descriptions within 500 characters and parameter descriptions within 150 characters.

Methodology

1Discover imperative registerTool calls and declarative forms with tool attributes, plus header and config exposure.
2Normalize each tool surface into a stable model with annotations, schema, behavior, network methods and source range.
3Evaluate each control and emit an evidence state: DETECTED, NO_FINDING, INCONCLUSIVE or NOT_ASSESSED.
4Prepare a bounded, non-overlapping rewrite diff for supported findings and show it for review.
5Rerun the check after applying the diff in memory before any real repository change.

CLI and CI

The LyraShield CLI can include WebMCP findings in lyrashield check-diff. You can fail a gate on HIGH or CRITICAL findings and export SARIF for GitHub Advanced Security. The GitHub Action uses the same gate and posts findings as annotations.

GitHub Action setup

Add the composite action to a workflow and gate pull requests on HIGH findings.

CLI setup

Run lyrashield check-diff locally and review the SARIF output.

Limitations

Static discovery cannot resolve dynamic behavior, runtime values or server-side context.
A NO_FINDING for a control only means the specific syntactic condition was not observed, not that the whole application is secure.
WebMCP is experimental. Browsers that do not support it cannot execute the registered tools even if the page registers them.
The free checker does not upload source, but it also does not replace a full repository scan, retest or evidence-backed report.

Questions

What is WebMCP?

WebMCP is an emerging browser protocol that lets a web page register tools for an AI agent through document.modelContext.registerTool or declarative form attributes. It is experimental and not yet supported in every browser.

Does WebMCP improve search rankings?

No. WebMCP may help an agent understand what your page can do, but it is not a ranking, indexing or citation guarantee.

What does the free checker do?

It analyzes selected source files or pasted code entirely in your browser for 14 WebMCP controls, prepares a bounded rewrite diff and exports JSON, Markdown or SARIF. Nothing is uploaded.

Can the tool rewrite my repository automatically?

No. The lab applies rewrites only in memory so you can review them. Repository-level fix proposals require an authenticated account and explicit approval.

Try the checker

Open the WebMCP Security Checker, load the unsafe sample and review the 14 controls without creating an account. The check runs in your browser and nothing is uploaded.

Open the WebMCP Security Checker Start free trial

The free checker reviews one surface. The trial reviews the repository behind it.