Can My Agent Uselookup · compare · cite

Aug 28, 2026 · Catalog foundation is up

Specification feature · interfaces

WebMCP permissions policyWebMCP draft 2026-08-26

Gate tool exposure across documents and origins through the tools permissions policy.

Terminology basis: WebMCP draft 2026-08-26. WebMCP draft 2026-08-26

WebMCP permissions policy: 1 supported, 0 partial, 0 unsupported, 30 unreviewed across 31 cataloged products.

Markdown · JSON

Explore this familyMore in WebMCP6 capabilities

Current evidence by product

Can my agent use WebMCP permissions policy?

Read across for the answer. 1 of 31 current product columns have reviewed evidence; unreviewed does not mean unsupported.

Known issues (0)Report an issue
  • Supported1
  • Partial0
  • Unsupported0
  • Unknown30
  • Not applicable0

Web

9 products

Desktop

13 products

CLI

9 products

Unknown means no public evidence has been reviewed for that product and capability. It does not mean unsupported.

How statuses are assigned

Definition and scope

What this capability means

Gate tool exposure across documents and origins through the tools permissions policy.

WebMCP is a draft Community Group Report, not a W3C Standard. Positive implementation cells must retain origin-trial, version, permissions, and agent-integration qualifiers.

Traceable compatibility

Assertion ledger

Documentation evidence only. No runtime conformance test is implied.

Chrome WebMCP origin trialdesktop · current
Supported
Target
Chrome 153 WebMCP origin-trial documentation · dated-documentation
Environment
preview-enabled
Observed
2026-08-28
  • origin-trialWebMCP is an experimental origin trial and local testing requires the enable-webmcp-testing flag
  • policythe tools policy defaults to self; cross-origin use requires iframe delegation plus explicit secure-origin exposure and request options
Evidence
  1. 1. Evidence checked 2026-08-28: Chrome documents both WebMCP APIs as gated by the `tools` Permissions Policy, defaulting to `self`, with explicit delegation required for cross-origin iframes and separate secure-origin exposure checks.