WebMCP
WebMCP in Chrome: setup, origin trial and tool testing
Flags, the origin trial, and the difference between the two. Plus how to confirm your tools registered, rather than assuming they did because the code ran.
Last reviewed 30 September 2026
Enable WebMCP for local testing or use an available origin trial for a deployed origin. Record your browser version and configuration, then verify registration and a controlled call. The browser tool test guide provides a fictional read-only demo.
Local development: the flag
Chrome's documentation describes a local WebMCP testing flag. Availability and exposed APIs depend on the browser build; check the installed version before following an older example.
- Open
chrome://flags/#enable-webmcp-testing. - Set it to Enabled and restart the browser.
- Confirm in DevTools:
typeof document.modelContextshould reportobject.
The Experimental Web Platform Features flag also carries it in some builds. If the dedicated flag is missing from your version, that is the fallback worth trying before concluding your channel does not have it.
Real visitors: the origin trial
A local flag affects that browser. Chrome documents an origin trial starting with Chrome 149 for deployed testing. Check the trial's current eligibility, supported versions and expiry before registering a token for your exact origin.
<meta http-equiv="origin-trial" content="YOUR_TOKEN_HERE"> Origin-Trial: YOUR_TOKEN_HERE
An origin trial token has an end date, and when it passes the API silently disappears for your visitors while continuing to work perfectly on your machine, where the flag is still set. Put the expiry in the same calendar as your TLS certificates, and make your feature detection log rather than fail quietly.
Permissions policy
Access is gated behind a policy-controlled feature named tools, with a default allowlist of ['self']. Top-level documents and same-origin iframes get it automatically. A cross-origin iframe does not, and calling into it throws NotAllowedError.
<iframe src="https://widget.example.com/booking" allow="tools"></iframe>
That matters more than it first appears: booking widgets, chat, configurators and checkout steps are routinely third-party iframes, and those are exactly the surfaces you would most want an agent to operate.
Confirming registration actually happened
Code running is not the same as a tool being registered — a rejected name, a missing secure context or a thrown handler all fail without a visible symptom. Ask the browser directly.
const tools = await document.modelContext.getTools();
console.table(tools.map(t => ({
name: t.name,
description: t.description.slice(0, 60),
readOnly: t.annotations?.readOnlyHint ?? false,
})));getTools() is in the current draft, but your browser build may not expose it. Chrome's Model Context Tool Inspector offers another way to inspect registration and manually call a tool. Our public checker inspects source signals and does not execute this browser test.
Common reasons nothing appears
| Symptom | Usual cause |
|---|---|
document.modelContext is undefined | Flag not enabled, browser too old, or the page is not a secure context |
| Works locally, not in production | Origin trial token missing, expired, or issued for a different origin |
NotAllowedError | Cross-origin iframe without allow="tools" |
| Registration resolves, tool never listed | Name outside the permitted character set, or an AbortSignal already aborted |
| Tool listed, never called | Description too vague to choose from — see the imperative API |
| Worked last month, gone now | You were on navigator.modelContext; see migration |
Where WebMCP access is enabled, open your page in ChatGPT's built-in browser and ask ChatGPT Work or Codex to complete the task your tool supports. Check that the tool is listed and called. If it is listed but not called, inspect its description and the client's available features before assuming registration failed.
Sources
Source references · article reviewed 30 September 2026
- developer.chrome.com/docs/ai/webmcp — Origin trial, flags, permissions policy directive
- webmachinelearning.github.io/webmcp — W3C Web Machine Learning Community Group draft — WebIDL, annotations, permissions policy
- learn.chatgpt.com/docs/webmcp — OpenAI WebMCP documentation — supported clients, rollout and current limitations
- developer.chrome.com/origintrials — Registering a trial and serving the token
- blog.cloudflare.com/webmcp — Chrome 146 experimental availability
- w3c.github.io/webappsec-permissions-policy — How the `tools` directive and allowlists behave
Keep reading
Check your own site against this
The Agent Readiness Score measures exactly what this article describes, and shows the evidence behind every finding.
Run the check →