WebMCP

The interesting thing about WebMCP is where it puts the server. Instead of you standing up an endpoint, the page you already ship *is* the endpoint: `webmcp.js` initializes a widget, and the four MCP primitives are registered in ordinary browser JavaScript. `registerTool('weather', ..., { location: { type: "string" } }, fn)` is the whole ceremony for a callable action. `registerResource` with `page://current` hands the client `document.body.innerHTML` as context; `registerResourceTemplate` with `element://{elementId}` lets an agent ask for one DOM node by ID, which is a neat way to give an agent narrow, deliberate context rather than the whole page. Prompts are the underrated piece — `registerPrompt('git-commit', ...)` with a required `changes` argument means you can standardise how a client phrases common requests across your site. Sampling is the design choice I'd defend hardest. When the server wants a completion, WebMCP opens a modal and the human types the response; the documented example asks for DuckDB SQL. That is a genuine safety story for anyone worried about autonomous agents, and it is built into the library rather than bolted on. Where it gets thin: the visitor must arrive with a configured MCP client and generate a token inside it, and the docs themselves tell you to restart the client if tools don't appear — so registering tools immediately after script load is guidance, not a nicety. Registration is JavaScript-only and in-page, so sites with strict script policies are out, and there's no persistent state and no authentication beyond the pasted token, which puts payments, orders and regulated data firmly out of scope. Site-by-site federation also means no turnkey cross-site view of what agents did. Where it fits: docs sites, portfolios, personal blogs, and prototypes where a developer wants to see an agent read a page and call a real action without committing engineering time. The surrounding ecosystem backs that up — a serverless reverse-geocoding endpoint with ESP32 and RP2040 clients shows the library reaching beyond browsers into low-power hardware, the Hide and Seek demo shows an agent actually playing against a page, and OpenAI's August 2026 WebMCP Challenge gave the approach a public build push. Where it doesn't: anything you'd have to defend in an audit, and anything that needs tool changes to propagate live without a client restart.