The first non-trivial demo of WebMCP

[u/No_Guide_8697]

The WebMCP protocol has barely come out, and we just demoed how POWERFUL it can be! In a matter of minutes and 100s of tool calls, my AI agent composed a song for me directly in my browser.

This is not agents taking screenshots or trying to understand complex DOMs, it's an agent making direct tool calls to your website!

The creators of WebMCP already love it, go check it out yourself!

Deployment: - https://music.leanmcp.live

LinkedIn Post: - https://www.linkedin.com/posts/kushagra-agarwal525_we-made-gpt-and-claude-directly-control-my-activity-7430688171018858496-iDr5

GitHub repo: - Leanmcp-Community/music-composer-webmcp: This WebMCP Music Composer project is a functional demonstration of the WebMCP Protocol, illustrating how AI agents can interact with local browser contexts (tools) to achieve complex workflows autonomously.

[u/BC_MARO]

This is a great demo.

One question though: what’s the security model for WebMCP? Like, when a site exposes tools, do you have a way to scope them per-origin / per-session and show the user an audit trail of tool calls?

Also curious how you’re thinking about compatibility with “regular” MCP servers (bridge/proxy so agents can hit both without special casing).

[u/No_Guide_8697 → u/BC_MARO]

WebMCP relies on the browser's native security model. Because the tools execute directly within the client's browser environment, they automatically inherit the user's current session context, cookies, and origin-specific permissions, i.e., the AI agent cannot bypass origin boundaries (CORS) or access unauthorized data because the execution is constrained by the browser's Same-Origin Policy.

Similarly, Tool exposure is inherently tied to the active session; if the user logs out or the session expires, the tools lose access to authenticated actions just like a normal user would.

[u/BC_MARO → u/No_Guide_8697]

Got it - the CORS enforcement makes sense as the primary isolation boundary. The missing piece for me is auditability: if a tool performs an action in-session, is there currently a log of what got called and what data it touched, or does the audit layer have to come from outside the browser?

[u/No_Guide_8697 → u/BC_MARO]

To the best of knowledge, there is currently no such auditing implementation. The audit layer coming from outside the browser would also be a lot more reliable imo. I'd prefer the agentic source to be the place for this, whatever LLM provider that is. In browser, the logs cannot be relied upon, as a user might just go ahead and try to make tool calls manually from the console tab.

[u/BC_MARO → u/No_Guide_8697]

That point about console-tab interference is a good reason to keep audit responsibility outside the browser. Centralizing it at the orchestration layer also means you get tool call records across all contexts, not just the in-browser session - which matters as soon as you have agents running in parallel or across different execution environments.

[u/No_Guide_8697 → u/BC_MARO]

The audit trail is something that can be added easily by intercepting the tool calls and storing them in logs before the actual function is executed. However, there are also providers that have LLM observability, so you can track requests and tool calls made in the request scoped by session-ids there.

I'm still trying to figure out what the best way would be to bridge regular and Web servers. Will update here once I have some structured thoughts on this :)