Turkey (Turkish)
Germany (German)
Worldwide (English)
Cloudflare announced WebMCP support for Browser Run as a developer preview.
Halkali merkez neighborhood fatih st ozgur apt no 46 , Kucukcekmece , Istanbul , 34303 , TR
WebMCP lets an agent discover explicit website tools instead of guessing UI interactions. This production guide covers discovery, invocation, permission boundaries, validation and rollback.
WebMCP is not a trusted hidden API layer. Treat browser-originated calls as untrusted, enforce authorization at the origin application and re-confirm sensitive actions.
As of 6 August 2026 WebMCP is a developer preview. Start with a low-risk read-only tool; do not expose state-changing actions without user confirmation, strict parameter validation and server-side authorization.
As of 6 August 2026 WebMCP is a developer preview. Start with a low-risk read-only tool; do not expose state-changing actions without user confirmation, strict parameter validation and server-side authorization.
Learn how WebMCP exposes structured website tools to browser AI agents, how to test discovery with Cloudflare Browser Run, and how to secure production usage.
Cloudflare announced WebMCP support for Browser Run as a developer preview.
Tools are declared through the page model-context surface and can be discovered by agents.
A read-only pilot is safer; payment or account-changing tools should come later.
Real authorization belongs at the origin application layer, not in the browser declaration.
Tool discovery and secure execution are separate concerns. Treating the layers independently makes debugging and authorization clearer.
For a pilot choose a narrow read-only action that returns the authenticated user’s own data.
Many apparent WebMCP issues are actually origin, session or CORS failures. Isolate normal HTTP first.
curl -I https://ornekalanadi.comcurl -sS https://ornekalanadi.com/api/order-status -H "Accept: application/json"curl -sS -D- https://ornekalanadi.com/ | head -40Prompt injection, over-privilege and unvalidated parameters are different failure classes with different controls.
| Risk | Signal | Control |
|---|---|---|
| Prompt injection | Agent selects an unexpected tool | Narrow descriptions, allow-list, user confirmation |
| Over-privilege | Write token used for a read-only task | Separate service identity and minimum scope |
| Parameter abuse | Unexpected ID, URL or file path | Server-side schema plus business-rule validation |
Version, log and roll back WebMCP tools like normal API changes.
WebMCP depends on more than browser code: origin APIs, logging, TLS, rate limiting and access policy must work together. Eka Sunucu can size the infrastructure for this workload.
Primary documentation and technical references used by this guide.
Continue with related infrastructure and implementation guides.
Cloudflare WebMCP
No. WebMCP focuses on exposing website tools inside a browser, while MCP is a broader client-server protocol for tools and context.
A production pilot is possible, but preview status means higher change risk. Avoid making critical workflows depend solely on it.
At the origin application. The browser declaration is a contract, not an authorization decision.
A low-risk read-only action such as status lookup, stock availability or documentation search.