# Runtime layering Source: https://docs.mcp-b.ai/explanation/architecture/runtime-layering Why MCP-B separates browser tool contracts, its server runtime, and transports. MCP-B keeps browser tool contracts separate from its server runtime and transport adapters. A native implementation or `@mcp-b/webmcp-polyfill` supplies the package-supported `document.modelContext` surface. `@mcp-b/webmcp-ts-sdk` adds `BrowserMcpServer`, which mirrors core tool operations while providing MCP-B-only capabilities. `@mcp-b/global` initializes those layers and connects the selected browser transport. Global initialization preserves the browser-shaped programming model: A native implementation or `@mcp-b/webmcp-polyfill` supplies the browser surface. `BrowserMcpServer` mirrors core tools, adds MCP-B extensions, and becomes `document.modelContext`. The transport connects explicit MCP clients without changing page code. Initialization returns no server handle. Application and library code keeps using `document.modelContext` normally, whether the active implementation is native, polyfilled, or wrapped by MCP-B. Cleanup restores the property descriptors that existed before wrapping; it does not uninstall the separately owned polyfill. This separation allows a library to depend only on types, a site to use only the tool-only polyfill, or an application to install the complete MCP-B runtime. Core tool registrations remain visible to native browser tooling, while cleanup can restore the context that existed before initialization. `navigator.modelContext` remains only as a deprecated compatibility alias. New integrations use `document.modelContext`. See the [`@mcp-b/global` reference](/packages/global/reference) and [Choose a runtime](/how-to/choose-runtime). # Tool lifecycle and dynamic registration Source: https://docs.mcp-b.ai/explanation/architecture/tool-lifecycle-and-context-replacement Why WebMCP tools must be registered, replaced, and removed as page context changes. A site's valid actions change with route, selected record, permissions, and workflow state. The published tool set should change with them. Agents should see only actions that are currently meaningful and authorized, with descriptions and schemas that match the active application context. ```mermaid theme={null} flowchart TD Current["Current registration"] -->|"context changes or cleanup"| Abort["Abort the old signal"] Abort --> Removed["Old tool is removed"] Removed -->|"another tool is valid"| Register["Register replacement
with a new signal"] Removed -->|"no tool is valid"| None["No registered tool"] Register --> Current Removed -. "toolchange" .-> Refresh["Consumers refresh their catalog"] Register -. "toolchange" .-> Refresh ``` The current registration pattern ties a tool to an `AbortSignal`: ```ts title="Registration lifetime" theme={null} const controller = new AbortController(); await document.modelContext.registerTool(tool, { signal: controller.signal }); // Remove the registration during route or component cleanup. controller.abort(); ``` Duplicate names reject instead of replacing the existing tool. When a route, description, schema, or permission boundary changes, abort the old registration before publishing the replacement: ```ts title="Replace a registration" theme={null} controller.abort(); const nextController = new AbortController(); await document.modelContext.registerTool(nextTool, { signal: nextController.signal, }); ``` The document remains the owner of this lifecycle. Callers do not retain a separate runtime or server handle. The `toolchange` event lets consumers refresh their catalog after registration or cleanup. See [Build your first React tool](/tutorials/first-react-tool) and the [WebMCP API sources](/reference/webmcp/standard-api). # Transports and bridges Source: https://docs.mcp-b.ai/explanation/architecture/transports-and-bridges Why WebMCP needs transports when page-hosted tools cross browser boundaries. WebMCP tools execute inside a document, while a consumer may run elsewhere in the document tree, a Chrome extension, or a desktop MCP client. The browser has a native mechanism for document-tree discovery. MCP-B transports solve a different problem: carrying MCP protocol messages between an explicit client and server. **Child:** registers and executes the tool. **Parent:** discovers its descriptor through the browser. Execution remains in the child document. **Parent:** MCP client. **Child:** MCP server and tool handler. A transport carries MCP messages across the frame boundary; execution remains in the child. ## Native cross-document discovery Native WebMCP stays within the browser's document model: 1. A parent delegates the `tools` Permissions Policy feature to a child with `allow="tools"`. 2. The child registers a tool with `exposedTo` when another origin should be able to discover it. 3. The parent includes that origin in `getTools({ fromOrigins })`. The browser returns `RegisteredTool` values with their owning `window` and `origin`. This path needs no MCP client, server, or transport. It does not add MCP-B name prefixes or carry MCP prompts and resources. ## MCP-B iframe bridging `@mcp-b/mcp-iframe` connects an MCP client in the parent to an MCP server in the child. The child server must be connected through `IframeChildTransport`; `@mcp-b/global` creates that server and selects the child transport automatically when loaded in an iframe. The parent element creates `IframeParentTransport`, lists the child server's items, and republishes them on the parent context. Tools and prompts receive an element-specific prefix. Resources receive `mcp-iframe:` wrapper URIs. A strict parent context can accept tools; prompts and resources require MCP-B extension methods. | Control | Native document discovery | MCP-B iframe bridge | | ---------------- | ------------------------- | ------------------------------------ | | Browser policy | `allow="tools"` | Independent of MCP connection | | Who may connect | Document tree | `allowedOrigins` | | Child exposure | `exposedTo` | `exposedTo`, within `allowedOrigins` | | Parent selection | `fromOrigins` | `target-origin` | | Payload | WebMCP tools | MCP protocol items | These controls are complementary, not interchangeable. `allow="tools"` does not create an MCP server, and `allowedOrigins` does not grant the native browser feature. On the bridge the two exposure controls stack: `allowedOrigins` decides which parents may connect, and `exposedTo` narrows one tool to a subset of them. A tool cannot reach an origin `allowedOrigins` already excludes. The browser enforces `exposedTo` on the native path. The bridge enforces it in the child's own JavaScript, so only the native path holds against a compromised child. ## Other MCP-B bridges `@mcp-b/transports` also provides: * `TabServerTransport` and `TabClientTransport` for an MCP client and server in the same `Window` * extension transports for Chrome `runtime.Port` connections accepted by extension code There is no dedicated user-script transport. Extension transports require the Chrome runtime messaging API and do not let an extension initiate a port into an ordinary web page. `@mcp-b/webmcp-local-relay` connects browser tools to desktop clients through localhost and stdio. Upstream `chrome-devtools-mcp` instead uses the Chrome DevTools Protocol for coding-agent workflows. ## Security boundary Each bridge establishes a security boundary. Origin validation, connection identity, extension permissions, and relay exposure must be configured in the corresponding package. For an iframe bridge, the parent validates `target-origin` and the child validates `allowedOrigins`. Tool execution remains in the child page even after the parent republishes its descriptor. ## Related pages * [Bridge tools across iframes](/how-to/bridge-tools-across-iframes) for the MCP-B setup * [mcp-iframe reference](/packages/mcp-iframe/reference) for element behavior and namespacing * [Transports reference](/packages/transports/reference) for low-level class contracts * [WebMCP API sources](/reference/webmcp/standard-api) for `exposedTo` and `fromOrigins` * [Connect desktop agents with local relay](/how-to/connect-desktop-agents-with-local-relay) for the localhost bridge # Security and human-in-the-loop Source: https://docs.mcp-b.ai/explanation/design/security-and-human-in-the-loop Why WebMCP security starts with browser mediation but still depends on application authorization. WebMCP tools can reuse a site's authenticated browser session. The session identifies the user; it does not make the agent trusted. Tool calls still pass through the application's validation and authorization rules. Tool metadata, page content, and tool output can contain prompt injection. Annotations provide information to browsers and agents, but they do not enforce authorization or guarantee a confirmation prompt. Human review should follow consequence: financial, destructive, external-communication, and privacy-sensitive actions need stronger confirmation than read-only lookup. Browser mediation, session identity, schemas, and annotations provide context. They do not authorize a call or guarantee confirmation. The application validates input, authorizes the current user, and requires human review when the consequence warrants it. The Community Group draft's [security and privacy considerations](https://webmachinelearning.github.io/webmcp/#security-and-privacy-considerations) cover the proposal's threat model. Chrome publishes separate guidance for [sites that expose tools](https://developer.chrome.com/docs/ai/webmcp/secure-tools) and [agents that consume them](https://developer.chrome.com/docs/agents/security). Those sources own browser and agent mitigation details. ## MCP-B bridges add another boundary Iframe, tab, extension, and localhost bridges carry tools beyond their original page surface. Each bridge must validate its own origin, connection identity, permissions, and exposure controls. Browser mediation does not configure an MCP-B transport, and transport access does not grant application permission. [Transports and bridges](/explanation/architecture/transports-and-bridges) describes these trust boundaries. The relevant package references define their specific controls. # WebMCP resources and status Source: https://docs.mcp-b.ai/explanation/design/spec-status-and-limitations Canonical sources for the WebMCP proposal, browser support, Chrome guidance, debugging, and testing. WebMCP is a Draft Community Group Report. It is not a W3C Standard or a Standards Track document. The proposal, browser implementations, and MCP-B packages can change on separate schedules. Use this page as a directory. Each linked source owns the details on its card. ## Proposal and implementation status Proposed API, algorithms, and security considerations. Explainers, issues, and proposal development. Browser and agent implementation links. Aggregated implementation and test status. Chrome rollout and experiment status. Cross-browser conformance results. Do not infer compatibility from a cached browser version or copied API table. Check the implementation source when making a release decision. ## Chrome developer documentation Chrome's WebMCP and agent resource hub. Chrome setup, availability, and limitations. JavaScript registration, discovery, and execution. Form attributes, submission, events, and focus states. Candidate tasks and tool boundaries. Tool names, schemas, outputs, and lifecycle design. User goals, initial state, recovery, and evaluation. Guidance for sites that expose tools. Guidance for agents that consume tools. Browser API and client-server protocol differences. ## Codex and ChatGPT Current Codex and ChatGPT Work support in the built-in browser. Dated observations compared with the Community Group draft. Runme's browser-side tools in a Codex workflow. ## Inspection and testing tools Manual inspection and invocation. Manual and model-assisted tool inspection. Let a coding agent inspect and invoke page tools. List tools discovered on a page. Find declarative schema problems. Category availability, prerequisites, and scoring model. Design deterministic tests and model evaluations. Deterministic smoke tests and experimental model evaluations. Experimental utilities, eval tooling, and demos. GoogleChromeLabs projects are experimental and are not officially supported Google products. Use the Chrome developer documentation above for supported Chrome guidance. ## Frameworks, demos, and community Angular lifecycle, forms, and testing guidance. Programmatic discovery and browser testing. Runnable comparison and WebMCP examples. Gemini-powered, polyfill-backed consumer demo. Experimental workflow for generating WebMCP code and evaluations. Community-maintained ecosystem directory. Experimental demos, libraries, and tools. Angular and Puppeteer label their WebMCP APIs experimental. Follow their own documentation for compatibility and release requirements. ## MCP-B documentation The [WebMCP API sources](/reference/webmcp/standard-api) and [declarative API sources](/reference/webmcp/declarative-api) route proposal questions upstream. [WebMCP and MCP-B extensions](/explanation/strict-core-vs-mcp-b-extensions) defines this project's boundary, while [Choose a runtime](/how-to/choose-runtime) and the [package index](/packages/index) document MCP-B behavior. # Essential concepts Source: https://docs.mcp-b.ai/explanation/index Understand where MCP-B fits, how its runtime works, and which trust boundaries it preserves. These explanations cover the concepts this project owns: MCP-B boundaries, runtime layers, transports, tool lifecycles, and security decisions. For current browser behavior, use the [WebMCP resources and status page](/explanation/design/spec-status-and-limitations). ## Platform and package boundaries Understand the proposal and where browser-hosted tools fit. See which capabilities belong to WebMCP and which MCP-B adds. ## Architecture Follow initialization from the browser API through the MCP-B runtime. Understand how tools move between pages, frames, tabs, and desktop clients. Understand registration lifetime, context replacement, and cleanup. ## Trust and status Understand MCP-B trust boundaries and user-controlled execution. Find upstream specifications, browser support, debugging tools, examples, and tests. For executable guidance, open the [tutorials](/tutorials/index) or [how-to guides](/how-to/index). For package APIs, open the [package index](/packages/index). # WebMCP and MCP-B extensions Source: https://docs.mcp-b.ai/explanation/strict-core-vs-mcp-b-extensions How MCP-B package behavior relates to the evolving WebMCP proposal. The WebMCP proposal and MCP-B packages evolve on separate schedules. The [Community Group draft](https://webmachinelearning.github.io/webmcp/) owns the proposed browser API. MCP-B package references own the behavior shipped by this project. The phrase **strict core** describes MCP-B's portable package boundary. It is not a second definition of the WebMCP proposal. Keeping that boundary narrow lets libraries publish tools through native implementations or the polyfill without depending on an MCP server or transport. ## Three related layers ```mermaid theme={null} flowchart TB subgraph Upstream["Community Group"] Proposal["WebMCP proposal
evolving document.modelContext API"] end subgraph Project["MCP-B packages"] Portable["Portable layer
types, helpers, polyfill"] Extensions["Extension layer
BrowserMcpServer, MCP features, transports"] Portable -->|"extended by"| Extensions end Proposal -->|"target browser contract"| Portable ``` The live draft owns the exact `ModelContext` members and signatures. MCP-B may retain compatibility types or adapters while browser implementations converge. Do not infer proposal status from where a method appears in an MCP-B type. ## Why the extension boundary exists `BrowserMcpServer` adds `listTools()`, prompt and resource registration, and a composed official MCP server. Transports, iframe routing, and the local relay connect that server to explicit MCP clients. These capabilities solve MCP-B integration problems; they are not browser API methods. Protocol-specific features remain available through `BrowserMcpServer.mcpServer`. Keeping them behind the composed server prevents the browser surface from becoming a second copy of the MCP SDK. Sites that only publish browser tools can use the portable layer. Applications that need prompts, resources, bridges, or desktop MCP clients use the extension layer. See [Runtime layering](/explanation/architecture/runtime-layering) for the composition model and [Choose a runtime](/how-to/choose-runtime) for package selection. # What is WebMCP? Browser tools for AI agents Source: https://docs.mcp-b.ai/explanation/what-is-webmcp Learn how WebMCP lets websites expose structured tools to AI agents through browser APIs, authenticated sessions, and visible user interfaces. WebMCP is a Community Group proposal that lets a web application publish structured actions as tools for AI agents. The site defines the actions and their inputs. The agent uses that contract instead of inferring behavior from screenshots, DOM structure, or click sequences. The browser is a useful home for these tools because the page already has the application's state, authorization checks, and visible interface. A tool can reuse that context without moving browser-only logic into a separate service. The application still validates inputs, enforces permissions, and asks for confirmation when the consequence warrants it. ```mermaid theme={null} sequenceDiagram participant Site as Web application participant Context as Browser WebMCP context participant Agent as AI agent Site->>Context: Register structured tools Agent->>Context: Discover and invoke a tool Context->>Site: Run the registered handler Site-->>Context: Return a structured result Context-->>Agent: Return the result ``` ## Learn about the proposal The [Community Group draft](https://webmachinelearning.github.io/webmcp/) owns the proposed JavaScript API. Chrome maintains the current [developer overview](https://developer.chrome.com/docs/ai/webmcp), [user journey guide](https://developer.chrome.com/docs/ai/webmcp/use-cases), and [WebMCP and MCP comparison](https://developer.chrome.com/docs/ai/webmcp/compare-mcp). The [WebMCP API sources](/reference/webmcp/standard-api) and [declarative API sources](/reference/webmcp/declarative-api) route implementation questions to their upstream owners. [WebMCP resources and status](/explanation/design/spec-status-and-limitations) collects status, security, inspection, and testing resources. ## Where MCP-B fits MCP-B provides packages around the proposal, including a polyfill, React bindings, transports, iframe bridges, and a local relay. Bridges can make page tools available to MCP clients, but the browser document remains the execution environment. MCP-B does not define the WebMCP proposal. [WebMCP and MCP-B extensions](/explanation/strict-core-vs-mcp-b-extensions) explains which behavior belongs to this project. [Transports and bridges](/explanation/architecture/transports-and-bridges) explains how those packages cross browser boundaries. # Add tools to an existing app Source: https://docs.mcp-b.ai/how-to/add-tools-to-an-existing-app Expose existing product functions as WebMCP tools with an MCP-B runtime. Wrap the functions your application already uses, then register those wrappers with `document.modelContext`. Keep business rules, authorization, and UI updates in the existing application path. ## Install the runtime For the complete MCP-B runtime, install and import `@mcp-b/global` before registering tools: ```bash title="Install the runtime" theme={null} pnpm add @mcp-b/global ``` ```ts title="main.ts" theme={null} import '@mcp-b/global'; ``` If you only need WebMCP tool registration, use the tool-only polyfill instead. See [Choose a runtime](/how-to/choose-runtime) before selecting a package. ## Wrap an existing function Call the same function used by your interface from the tool handler. Use an `AbortSignal` to remove the tool when the capability is no longer available. ```ts title="cart-tool.ts" theme={null} const controller = new AbortController(); await document.modelContext.registerTool( { name: 'add-to-cart', description: 'Add a product to the shopping cart', inputSchema: { type: 'object', properties: { productId: { type: 'string' }, quantity: { type: 'integer' }, }, required: ['productId'], }, async execute(args) { const item = await addToCart(args.productId, args.quantity ?? 1); return { content: [{ type: 'text', text: `Added ${item.name} to cart` }], }; }, }, { signal: controller.signal } ); export function removeCartTool() { controller.abort(); } ``` Create the controller when the user, route, or feature state makes the capability available. Call `removeCartTool()` when that state becomes invalid. A later registration can reuse the same tool name after the previous signal is aborted. For React components, use the lifecycle-aware hooks in [Integrate with your framework](/how-to/frameworks). ## Verify the registration Check the page registry after your registration promise resolves: ```js title="Browser console" theme={null} const tools = await document.modelContext.getTools(); console.table(tools.map(({ name, description }) => ({ name, description }))); ``` Use Chrome's [WebMCP DevTools panel](https://developer.chrome.com/docs/devtools/application/webmcp) to inspect schemas and invoke tools without maintaining a separate browser-debugging workflow. ## Finish the integration * Add MCP-B input adapters or structured output in [Use input schemas and structured output](/how-to/use-schemas-and-structured-output). * Follow Chrome's [WebMCP best practices](https://developer.chrome.com/docs/ai/webmcp/best-practices) for tool boundaries, names, descriptions, and agent-facing errors. * Follow Chrome's [secure tools guidance](https://developer.chrome.com/docs/ai/webmcp/secure-tools) before exposing destructive or externally visible actions. * If discovery fails, use [Debug and troubleshoot](/how-to/debug-and-troubleshoot) to trace the MCP-B runtime and transport. # Bridge tools across iframes Source: https://docs.mcp-b.ai/how-to/bridge-tools-across-iframes Connect a child-frame MCP server to its parent with the mcp-iframe custom element. This guide uses `` to connect a parent-side MCP client to an MCP server in a child frame. The element republishes the child's tools on the parent's `document.modelContext` and, when the parent provides MCP-B extensions, also republishes prompts and resources. Native cross-document discovery is a separate browser mechanism. The parent delegates the `tools` feature with `