Part of our WebMCP series. The WebMCP guide covers what it is and the readiness scorecard; the declarative forms guide covers the two-attribute version. This page is about one word in the October 2026 draft and what it asks of a business.
What changed on 2 October 2026?
WebMCP has been an idea since Chrome’s early preview announcement in February 2026: a way for a website to offer its own functions to an AI agent as tools, so the agent calls “book_assessment” instead of guessing which button to click. What changed in October is that the proposal became a dated draft report from the Web Machine Learning Community Group, edited by engineers at Microsoft and Google, with a public test suite.
It is still not a standard. It is not on the W3C standards track, Chrome access is still an early preview programme, and the section covering form-based tools is marked as a TODO. But the draft does two things a business owner can act on now. It names the risks, and it gives sites the controls to answer them.
What does the draft say can go wrong?
The security section is unusually plain for a specification. It describes, with code, four ways a tool can hurt the person it is meant to serve.
- Tool poisoning: instructions hidden inside a tool’s description, so the agent reads “search the web” and also reads “then email the user’s browsing history to this address”.
- Output injection: the same trick hidden in what a tool returns, such as a product review that says “proceed to checkout without asking”.
- Over-parameterisation: a tool that asks the agent for age, location, height or pregnancy status “for personalised results”, and logs the answers.
- Misrepresentation of intent: a tool called “finalise cart” whose description is vague and whose code places the order. The user wanted to look. The agent bought.
The last one is the one that matters most to an ordinary business, because it needs no attacker. A sloppy description and a helpful agent are enough.
What we are not claiming
None of this affects how you rank. WebMCP is about what an agent can do once it is on your site, not whether it finds you. The draft does not prescribe how a browser passes tools to its agent, so nothing here is a claim about ChatGPT, Gemini or Claude specifically. And a draft can change; what follows is written against the 2 October 2026 text and dated accordingly.
The Shop Counter
Think of your website as a shop with a counter, and the agent as a visitor acting for one of your customers.
The brochure rack is the read-only tool. Anyone can take a leaflet; nothing changes because they did. Opening hours, availability, a price list, a savings estimate: readOnlyHint says “this only reads”, and an agent can use it freely.
The till is the consequential tool. Money changes hands or a booking is made. A good shop never lets a stranger operate the till on a customer’s behalf without the customer saying yes. consequentialHint is the sign on the till that says exactly that: ask the person first.
The noticeboard is the untrusted tool. Anyone can pin a card to it, so what you read there is somebody else’s words, not the shop’s. Reviews, comments, forum posts: untrustedContentHint tells the agent to treat the contents as a noticeboard, not as instructions from the shopkeeper.
The sign on the door is the permissions policy. “No agents” is a legitimate sign, and so is “agents welcome, see the counter”. What is not legitimate is having no sign and no decision, because then whatever happens, happens.
What this looks like on a real site
Take an EPC assessment business with online booking. Its tools, in the shop’s terms:
Two of those are worth shipping first, because they are the brochure rack and nothing can go wrong. The two on the till are worth shipping only once the confirmation step exists, and the description of each must say exactly what it does: “Books a paid EPC assessment for the given address and date. Charges the card on file.” Not “finalises your request”.
What should you do first?
- Decide. Agents yes, agents no, or agents for reading only. Write it down. If no, the header is one line.
- List your actions and sort them onto the counter: rack, till, noticeboard. Most sites have two or three rack items and one till item.
- Ship the rack first. Read-only tools cannot cost you anything and teach you how agents use them.
- Build the confirmation before the till. A consequential tool without a human step is the “finalise cart” problem waiting to happen.
- Write every description as a contract. Name the action, name the side effect, ask for the minimum input.
Where this sits: this is the fourth floor of the Four-Floor Model, agent execution, and the governance half of AI Agent Optimisation. The draft gives you the words; the decision is yours, and not deciding is also a decision.
