WebMCPScanner

Free WebMCP readiness check

Is your website ready for AI agents?

Scan any page: we render it in a real browser, capture every WebMCP tool it registers, validate schemas and annotations, and audit the security headers and discovery files agents rely on. You get a shareable report with a score, a grade and fixes you can paste.

Try it on this site — or read a full description of every check.

What the scan checks

18 scored checks in four categories, plus observations. Every result shows its evidence.

A WebMCP tools

40 points

  • Tools exposed to agents
  • Imperative registration conforms to the spec
  • Declarative tool forms

B Tool contract quality

20 points

  • Tool names
  • Tool descriptions
  • Input schemas
  • Annotations match behaviour
  • Prompt-injection & sensitive-data hygiene

C Security & compatibility

20 points

  • HTTPS (secure context)
  • Content Security Policy
  • No mixed content
  • Permissions-Policy 'tools'
  • Strict-Transport-Security

D AI discoverability

20 points

  • Schema.org structured data
  • llms.txt
  • Meta description
  • Open Graph tags
  • robots.txt lets AI agents in

Built to go deeper than a static checker

Real JavaScript execution

Pages are rendered in headless Chromium (Cloudflare Browser Run). Tools registered by scripts, frameworks or after load are captured with their full schema and timing.

Spec-accurate validation

Names, descriptions and duplicates are judged with the registration rules of the current W3C draft; annotations are compared with what each tool's verb implies; schemas are checked property by property.

Security, not just SEO

Prompt-injection indicators in descriptions, sensitive parameters, CSP, HSTS, mixed content and the tools Permissions-Policy that can silently switch WebMCP off.

Fixes with code

Every lost point comes with an explanation, a snippet adapted to your page and the reference to read.

Share and automate

A report link to share for one hour, a JSON version of every report and a documented API.

Then test for real

Open your tools in the WebMCP Explorer Chrome extension to run them, record timelines and review their security.

From the blog

All articles →

Questions

What is WebMCP?

WebMCP is a browser API, drafted at the W3C Web Machine Learning Community Group with Chrome as first implementer, that lets a web page register "tools" — functions with a name, a description and a JSON input schema — which AI agents in the browser can call instead of clicking around the page.

How does the scanner see my tools?

It loads your page in a real headless Chromium with a recording script installed before your code runs. When the browser has WebMCP enabled the native API is wrapped; otherwise a stand-in that applies the specification rules records each registerTool() call. Declarative forms are read from the rendered DOM. Tools are never executed.

Is it free?

Yes. Scans are free and need no account. Fair-use limits apply per visitor to keep the shared browser capacity available to everyone.

What is stored?

Only the scanned address (origin and path — query strings are dropped) and the report, for one hour at most: the report is deleted when you close it. No account, no cookie, no IP address with reports. See the privacy page.

My site has no WebMCP tools yet. Is a scan useful?

Yes: the report still checks HTTPS, CSP, Permissions-Policy, structured data, llms.txt, Open Graph and robots.txt, and gives copy-paste code to register your first tool.

Is the score official?

No. It is our own transparent heuristic (ruleset 2026-10-21), published in full on the scoring page. It is not a certification and not a search ranking factor.