WebMCP browser tool declaration

What the scanner requests

• /.well-known/webmcp.json
• /.well-known/webmcp
• /webmcp.json

It also reads documents it has already fetched: $home.

What is measured

The scanner GETs /.well-known/webmcp.json, /.well-known/webmcp and /webmcp.json, and also inspects the homepage. It passes when it finds a tool declaration, either a tools array whose entries each give a name, a description and a JSON Schema inputSchema, or the equivalent in-page document.modelContext.registerTool({...}) calls. It partially passes when tools are declared without an inputSchema or description, or when the page only loads the WebMCP API without registering any tool.

Reproduce it yourself

You do not have to take our word for any of this. Run the same measurement against your own domain:

              DOMAIN=https://your-domain.example
for p in /.well-known/webmcp.json /.well-known/webmcp /webmcp.json; do printf '%s -> ' "$p"; curl -sS "$DOMAIN$p" | jq -c '[.tools[]? | {name,description,inputSchema}]' 2>/dev/null || echo "missing or not JSON"; done
            

The fix

This is the artifact to ship. It is the complete change, not a description of one.

              {
  "tools": [
    {
      "name": "search_products",
      "title": "Search products",
      "description": "Search the public catalogue by free-text query and return matching products with prices.",
      "inputSchema": {
        "type": "object",
        "properties": {
          "query": { "type": "string", "description": "Free-text search query" },
          "limit": { "type": "integer", "minimum": 1, "maximum": 50, "default": 10 }
        },
        "required": ["query"],
        "additionalProperties": false
      }
    }
  ]
}
            

Standards referenced

• W3C WebMCP

Related checks