WebMCP lets a site fully disable agent tool calls on pages that do not need them with Permissions-Policy: tools=(), and mark irreversible actions with consequentialHint so the agent asks the person first.
WebMCP, a draft that lets web pages offer tools to AI agents, also gives the site an off switch: one HTTP header turns agent tool calls off on pages that do not need them. It also lets a site mark an action that cannot be undone, so the agent asks the person first.
Why I read it
My scanner looks at both sides of a site: how open it is to AI, and how well it keeps closed what should be closed. WebMCP is the newest door. In the draft dated 20 October 2026, a page can register tools, such as search, add to cart or book a slot, that an AI agent in the browser calls directly instead of clicking through the page.
The WebMCP draft is a Community Group report. It is not on the W3C Standards Track. I read it on 22 October looking for one thing: can a site say no?
The off switch
Yes. WebMCP adds a feature called tools to Permissions-Policy. Its default is 'self': tools are allowed for the site's own pages unless the site says otherwise. Section 6.4.1 advises: "Disable access to WebMCP APIs in documents where WebMCP is not an intended capability."
In practice that is one response header on the pages concerned:
Permissions-Policy: tools=()
Company profile pages, blog posts and login pages rarely need an agent to call anything.
The ask-first flag
For the pages that do have tools, the draft offers consequentialHint. It marks a tool whose action is "significant, real-world, or non-reversible": placing an order, paying, cancelling a booking. The agent is expected to check with the person before calling it.
One line in the draft matters for expectations. Defending against prompt injection is "primarily the responsibility of the agent". The site's hints are hints, not a lock.
What you can do
Nothing urgent. If you do not use WebMCP, your pages register no tools. If you or a vendor start to:
- Send
tools=()on every page that has no reason to offer tools. - Mark ordering, payment, cancellation and deletion with
consequentialHint. - Keep your own server-side checks. A hint does not replace them.
What this does not prove
- No site in my scan sample has turned WebMCP on yet, so I have measured nothing. This is a reading of a draft.
- The draft is still changing. Names and defaults may move.
- Whether real agents respect these hints is not known.
Where this sits among the other ways to open or close a site: Open and closed to AI.
Sources
The measurements behind this are on Parallel World
What this does not prove
no site in our sample has enabled WebMCP yet; the draft is still changing.