WebMCP declarative API

Why it matters

WebMCP form annotations describe potential browser tools. Static source inspection does not execute the tools or verify that a signed-in task can finish.

How to fix it

Annotate your main forms with WebMCP toolname and tooldescription attributes.

1. Add toolname and tooldescription to each form that agents may use.

   <form toolname="search" tooldescription="Search products by keyword">
     <input name="q" toolparamdescription="Search keywords">
   </form>

2. Or register tools in JavaScript with document.modelContext.registerTool().

   document.modelContext.registerTool({
     name: "search",
     description: "Search products",
     inputSchema: {type: "object", properties: {q: {type: "string"}}},
     execute: async ({q}) => ({content: []})
   });

Verify

Run a new scan for this checkpoint: