Skip to main content
@mcp-b/webmcp-extension provides a Chromium MV3 template and a client helper for extension-owned WebMCP integration. A MAIN-world content script installs the runtime, page code uses document.modelContext or declarative HTML forms, and an isolated content script receives the official MCP Client.

​
When to use this package

  • You want an extension to install WebMCP on matching pages.
  • You want page runtime installation separated from isolated client code.
  • You want to discover and call imperative and declarative page tools through the official MCP client API.

​
When not to use this package

  • Your page can install its own runtime. Use @mcp-b/global.
  • You need a background worker or Chrome runtime-port server. This package’s template connects an isolated content script to the current page.

​
Where it sits in the package graph

The MAIN-world entry imports @mcp-b/global. The isolated entry calls connectWebMCPClient(), which connects an MCP client to that page. The package does not replace or wrap the website API: site code still registers tools with document.modelContext, and annotated forms become tools through the native or polyfilled declarative runtime. Both tool types use the same listTools() and callTool() methods from the isolated content script. The extension does not scan forms itself. @mcp-b/global owns the page runtime, including its declarative support and compatibility boundary. The shipped content scripts target top-level pages only. Native Chrome still exposes imperative and declarative tools from same-origin child documents through frame-tree discovery. The polyfilled path remains scoped to the top document. The reference page lists the cross-origin and navigation boundaries.

​
Security boundary

MAIN-world code shares the website’s JavaScript environment. Keep extension secrets, credentials, and privileged Chrome APIs out of that bundle. Treat page tool metadata, arguments, and results as untrusted. Authorize privileged actions from trusted extension state, never from page-provided values alone. For the broader threat model, see Security and human control.

​
First step

Start with the included template, then narrow its manifest match patterns to the sites your extension supports. The reference page documents the manifest, build shape, exported helper, and security constraints.

Reference

Manifest structure, world boundaries, client helper, and template build.

@mcp-b/global overview

Runtime installed by the MAIN-world entry.

Declarative API

Annotated forms, browser behavior, and polyfill compatibility.

Security and human control

Security principles for page tools and agent access.