On August 6, 2026, Cloudflare announced the launch of a developer preview of WebMCP, a method that allows any website running through Cloudflare to provide an interface for AI agents inside the browser by enabling a single setting. This does not require writing new code or making changes to the website’s origin server. Instead, Cloudflare adds a small bridge to HTML pages at the edge, and this bridge registers a set of tools that the visitor’s agent can discover and invoke.
The move comes in response to an increasing share of web visits shifting to AI agents rather than direct users. Instead of relying on crawling and copying content to external servers, WebMCP allows agents to interact with tools defined by the website itself, while keeping the visit’s traffic within the website experience and allowing the user to remain in control.
A Unified Interface Inside the Browser
WebMCP is a new browser standard being shipped experimentally in Chrome 146. It appears on the page through document.modelContext. A website can choose which tools it wants to make available to agents, reducing the agent’s need to guess the locations of buttons and fields or carry out navigation steps designed primarily for humans.
Cloudflare had previously added WebMCP support to BrowserRun, its remote browser, allowing the agent to discover and invoke the tools exposed by a website. Cloudflare Radar will also soon provide its own WebMCP tools. This preview focuses on enabling other websites to provide the same tools through a single switch.
How the Preview Works
The implementation consists of two components that operate in front of the origin server. When WebMCP is enabled from the Cloudflare dashboard, the company uses HTMLRewriter to add a reference to the bridge script in every HTML response. The tag and script come from the edge and the same domain, while the rest of the page content remains unchanged, whether the website is static or a single-page application.
The bridge runs inside the page and searches for the WebMCP interface in the browser. If the interface is unavailable, it takes no action, and the page continues to work as before. When it is available, the bridge loads the tool packages specified in the page configuration and registers them using registerTool.
Each package consists of MCP tool descriptions and handlers. Static packages can define their tools in advance, while dynamic packages can discover tools at startup. If the website has an existing MCP server, the bridge can connect to its endpoint, by default at the /mcp path, using the visitor’s session and on the same origin.
Packages Available in the Preview
- Content Credentials: Scans images and reads C2PA content provenance data locally inside the browser. The scan_images_c2pa tool can scan images and return a summary including the presence of credentials, the format, the number of data items, and the name of the signing organization when available.
- Site MCP Server: Discovers the website’s MCP server tools and registers intermediary tools that the visitor’s agent can invoke, sending the request to the website using its current session.
The tools in this preview operate entirely inside the visitor’s browser and do not require a round trip to a Cloudflare-operated server. The Content Credentials package reads a few kilobytes from the image header to extract provenance data, without reading the entire image.
An Important Limitation in Reading C2PA Data
The inspect_image_c2pa tool can decode the complete image manifest, including the modification history, the declared author, and the signing certificate. However, Cloudflare explains that the current implementation only reads and displays the credentials; it does not cryptographically verify them. Therefore, every result carries the value signatureVerified: false so that the agent does not confuse a decoded claim with a credential that has been verified.
Activation and Availability
Developers can access WebMCP through Agent Readiness, then WebMCP, in the Cloudflare dashboard, enable the feature for a domain, and choose the tool packages. The Content Credentials and Site MCP Server packages are enabled by default in the preview, with additional packages potentially appearing later without requiring the website to be redeployed.
After activation, the website’s next HTML response includes the WebMCP bridge. This can be verified by searching for the word WebMCP in the HTML. BrowserRun can also be used to direct Cloudflare’s remote browser to the website and confirm that the agent discovers and invokes the tools. Cloudflare asks developers to try the preview and submit feedback through the Cloudflare Developers Discord or the community forum.