Skip to content
TestWebMCP

How it works

Test WebMCP loads your page in a real browser, records the WebMCP tools it registers, and calls the read-only ones to check that they work. Then it scores the page out of 100.

What a scan does

  1. 01

    Load the page

    We open your page in Chrome with WebMCP turned on and ask Chrome which tools the page registered, the same way an agent would. We wait a few extra seconds after loading, so tools added later still count.

  2. 02

    Read form tools

    We look for forms with a toolname attribute and record their description and fields.

  3. 03

    Test the tools

    We call each tool that only reads information, with test inputs based on its inputSchema, and check what comes back.

  4. 04

    Check it works for visitors

    We check your HTTPS certificate and look for an origin trial token. Chrome needs both before it turns WebMCP on for the people visiting your site.

Which tools we call

We only call tools that are marked readOnlyHint: true, or whose names start with words like get, search or list. Tools that look like they change something, such as create_order or send_email, appear in your report but are never called, even if they are marked read-only.

When a tool finds nothing

Our test inputs are made up, so a search tool may return no results. That's normal, and we don't count it against you. A tool only fails if it returns an error, doesn't respond, or returns something unusable.

To have your tools tested with realistic values, add an example to the properties in your inputSchema. We use it instead of a made-up value.

Scoring

100 pts

Everything scored is part of WebMCP. Tool quality follows Chrome's WebMCP best practices and doesn't ask for anything more. A check that fails says what we found, why it matters and how to fix it.

Working tools count for the most. Tools that work and are well described get an A even before you have an origin trial token. An A+ means every check passes.

A+ 100 · A 85+ · B 75+ · C 65+ · D 55+ · E 35+ · F below 35

Registration

60 pts
R1 · 20
At least one tool is registered with JavaScript. Tools registered on navigator.modelContext get 5: Chrome doesn’t support that old name, so visitors can’t use them.
R2 · 5
The page has a form with a toolname attribute. Full marks without one if R1 passes: you only need one of the two.
R3 · 30
The tools we call return results. Each one that returns an error, doesn’t answer, or returns something unreadable costs its share: 1 failing out of 4 loses a quarter of the points. At least one tool has to return a result.
R4 · 5
The first tool is registered within 5 seconds of the page starting to load.

Tool quality

15 pts
Q1 · 5
Every tool has a valid inputSchema, and every field in it has a description.
Q2 · 3
Every tool has a description of at least a few words that doesn’t just repeat the name.
Q3 · 2
No tool has a vague name like tool1 or submit. Any style is fine: search_products, searchProducts or search-products.
Q4 · 3
Every tool sets readOnlyHint, so agents know whether it changes anything.
Q5 · 2
Tools we call return something, and less than 20,000 characters.

Ready for visitors

25 pts
P1 · 5
The page uses HTTPS with a valid certificate. Chrome only turns WebMCP on for HTTPS pages.
P2 · 15
The page has an origin trial token. WebMCP is still being tested in Chrome, and only works for visitors on sites that signed up and added their token.
P3 · 5
No errors stopped your tools from registering, such as Chrome refusing a tool or your Content Security Policy blocking the script.

Limits

  • You can scan one URL per day for free. A scan takes up to a minute.
  • Opening a report again doesn't count as a scan, so report links are free to share.
  • Only public websites can be scanned.
  • You can also scan with the free API. It shares the same daily scan.

Scan a URL to see a report.