All checks › API, Auth, MCP & Skills
WebMCP
Why it matters
It is the only protocol designed for agents that browse the web with a real browser instead of calling server APIs. Exposing document.modelContext lets these 'browser-native' agents discover and use actions directly in the page's DOM, with no separate server integration — useful even on pages behind a login, in the user's own session. A word of warning: since modelContext runs in the page's own JS context, any XSS vulnerability on the site gives access not only to cookies but to the very tools exposed to the agent — an attack's blast radius grows with the power of the published tools.
Want to see how your site does?
The free scan runs this and every other check in about 30 seconds and shows the evidence for each one.
Scan my site for free