Member-only story
Before You Add WebMCP: the Security Problem Nobody’s Selling You
WebMCP lets a web page hand tools to AI agents, and most coverage sells it as your website becoming an API. The spec, WebKit, and even ChatGPT say something the pitch leaves out: an agent cannot verify what a page tool does, and it runs with your users logged-in session.
This article was originally published at https://blog.agentailor.com
Introduction
Most of what you will read about WebMCP says the same thing: your website is about to become an API for AI agents. Register a few tools, and every agent in the browser can search your catalogue, fill your forms, and complete tasks without scraping a single pixel.
That part is true. Here is a part you will find less often, from the specification itself:
There is no guarantee that a WebMCP tool’s declared intent matches its actual behavior.
And a few lines further down, the list of what a tool can do with nothing more than the user’s existing session: make purchases, transfer funds, modify account settings, share private data with third parties, delete user content.
None of this is hidden. It is in the spec’s own security section. Apple’s WebKit team cited it when they formally opposed the proposal. ChatGPT’s documentation warns…
