Skip to main content
WebMCP tools can reuse a site’s authenticated browser session. The session identifies the user; it does not make the agent trusted. Tool calls still pass through the application’s validation and authorization rules. Tool metadata, page content, and tool output can contain prompt injection. Annotations provide information to browsers and agents, but they do not enforce authorization or guarantee a confirmation prompt. Human review should follow consequence: financial, destructive, external-communication, and privacy-sensitive actions need stronger confirmation than read-only lookup.

Context and signals

Browser mediation, session identity, schemas, and annotations provide context. They do not authorize a call or guarantee confirmation.

Enforced controls

The application validates input, authorizes the current user, and requires human review when the consequence warrants it.
The Community Group draft’s security and privacy considerations cover the proposal’s threat model. Chrome publishes separate guidance for sites that expose tools and agents that consume them. Those sources own browser and agent mitigation details.

​
MCP-B bridges add another boundary

Iframe, tab, extension, and localhost bridges carry tools beyond their original page surface. Each bridge must validate its own origin, connection identity, permissions, and exposure controls. Browser mediation does not configure an MCP-B transport, and transport access does not grant application permission. Transports and bridges describes these trust boundaries. The relevant package references define their specific controls.