Skip to content
TestWebMCP

How it works

Test WebMCP loads your page in a real browser, records the WebMCP tools it registers, and calls the read-only ones to check that they work. Then it scores the page out of 100.

What a scan does

  1. 01

    Load the page

    We open your page in Chrome with WebMCP switched on, then ask Chrome which tools the page registered, the same way an agent would. We wait for the page to finish loading, and a few seconds more, so tools added by JavaScript after the first load are included.

  2. 02

    Read declarative forms

    We look for forms with a toolname attribute and record their description and fields.

  3. 03

    Test the tools

    We call each read-only tool through Chrome with test inputs based on its inputSchema, and check what comes back.

  4. 04

    Check your site files

    We look for llms.txt, an MCP server card, an agent skills index and robots.txt, and check your HTTPS certificate.

Which tools we call

We only call tools that are marked readOnlyHint: true, or whose names start with words like get, search or list. Tools that look like they change something, such as create_order or send_email, appear in your report but are never called, even if they are marked read-only.

When a tool finds nothing

Our test inputs are made up, so a search tool may return no results. That's normal, and we don't count it against you. A tool only fails if it returns an error, doesn't respond, or returns something unusable.

To have your tools tested with realistic values, add an example to the properties in your inputSchema. We use it instead of a made-up value.

Scoring

100 pts

Each check that fails explains what we found, why it matters and how to fix it. Each check that passes shows what we found.

Registration

40 pts
R1 · 15
At least one tool is registered on document.modelContext. Tools registered only on navigator.modelContext get 5: that is the older name, and Chrome doesn’t provide it, so those tools don’t work for visitors.
R2 · 5
The page has forms with a toolname attribute. If tools are registered with JavaScript instead, this still gets full marks. You only need one of the two.
R3 · 15
At least one read-only tool returned a result when called. Scores 0 if any tested tool returns an error, times out or returns something unusable.
R4 · 5
The first tool is registered within 5 seconds of the page starting to load.

Tool quality

25 pts
Q1 · 8
Every tool has a valid JSON Schema inputSchema of type object, with a description on each property.
Q2 · 5
Every description is at least 20 characters and says what the tool returns.
Q3 · 4
Every name is in snake_case or camelCase and starts with a verb, like search_products.
Q4 · 5
Every tool has readOnlyHint set, and tools that return content from other sources have untrustedContentHint.
Q5 · 3
Tested tools return a result that isn’t empty and is under 20,000 characters.

Discoverability

20 pts
D1 · 5
/llms.txt exists and isn’t empty. We also note /llms-full.txt, but it isn’t scored.
D2 · 5
/.well-known/mcp.json or /.well-known/mcp/server-card.json exists and is valid JSON.
D3 · 3
/.well-known/agent-skills/index.json exists.
D4 · 4
The page has at least one JSON-LD block.
D5 · 3
robots.txt doesn’t block GPTBot, ClaudeBot, Google-Extended or PerplexityBot. No robots.txt also passes.

Platform readiness

15 pts
P1 · 5
The page is served over HTTPS with a valid certificate. Browsers only enable WebMCP on HTTPS pages.
P2 · 5
The page has a WebMCP origin trial token, in a meta tag or an Origin-Trial header. Without one, Chrome doesn’t enable WebMCP for your visitors.
P3 · 5
No WebMCP-related console errors, and no scripts blocked by your Content Security Policy.

Good to know

  • You can scan one URL per day for free. A scan takes up to a minute.
  • Opening a report again doesn't count as a scan, so report links are free to share.
  • Only public websites can be scanned.

Scan a URL to see a report.