WebMCP report
googlechromelabs.github.io
https://googlechromelabs.github.io/webmcp-tools/demos/pizza-maker/
7 tool(s) registered. None could be tested safely.
Registered tools
add_toppingdocument.modelContextregisterTool · 504msAdd one or more toppings to the pizza
inputSchema
{
"type": "object",
"required": [
"topping"
],
"properties": {
"size": {
"enum": [
"Small",
"Medium",
"Large",
"Extra Large"
],
"type": "string"
},
"count": {
"type": "integer",
"maximum": 50,
"minimum": 1,
"description": "Number of toppings to add"
},
"topping": {
"enum": [
"🍕",
"🍄",
"🌿",
"🍍",
"🫑",
"🥓",
"🧅",
"🫒",
"🌽",
"🌶️",
"🐑"
],
"type": "string"
}
}
}manage_pizzadocument.modelContextregisterTool · 504msManage pizza state
inputSchema
{
"type": "object",
"required": [
"action"
],
"properties": {
"action": {
"enum": [
"remove_last",
"reset"
],
"type": "string"
}
}
}remove_toppingdocument.modelContextregisterTool · 504msRemove a specific topping from the pizza
inputSchema
{
"type": "object",
"required": [
"topping"
],
"properties": {
"all": {
"type": "boolean",
"description": "Remove all toppings of this type"
},
"topping": {
"enum": [
"🍕",
"🍄",
"🌿",
"🍍",
"🫑",
"🥓",
"🧅",
"🫒",
"🌽",
"🌶️",
"🐑"
],
"type": "string"
}
}
}set_pizza_sizedocument.modelContextregisterTool · 503msSet the pizza size directly or infer it based on the number of people.
inputSchema
{
"type": "object",
"properties": {
"size": {
"enum": [
"Small",
"Medium",
"Large",
"Extra Large"
],
"type": "string",
"description": "The specific size name."
},
"number_of_persons": {
"type": "number",
"description": "The number of people eating to help infer the correct size."
}
}
}set_pizza_styledocument.modelContextregisterTool · 504msSet the style of the pizza (colors/theme)
inputSchema
{
"type": "object",
"required": [
"style"
],
"properties": {
"style": {
"enum": [
"Classic",
"Bianca",
"BBQ",
"Pesto",
"Wales"
],
"type": "string"
}
}
}share_pizzadocument.modelContextregisterTool · 504msGet a shareable URL for the current pizza creation
inputSchema
{
"type": "object",
"properties": {}
}toggle_layerdocument.modelContextregisterTool · 504msControl pizza layers (sauce, cheese). Use "add", "remove", or "toggle".
inputSchema
{
"type": "object",
"required": [
"layer"
],
"properties": {
"layer": {
"enum": [
"sauce-layer",
"cheese-layer"
],
"type": "string"
},
"action": {
"enum": [
"add",
"remove",
"toggle"
],
"type": "string"
}
}
}Registration
30/60- Pass
Tools registered with JavaScript R1
20/207 tool(s) registered.
- Tools: add_topping, manage_pizza, remove_topping, set_pizza_size, set_pizza_style, share_pizza, toggle_layer
- First tool registered 503ms after the page started loading.
- Pass
Tools registered through forms R2
5/5No form tools, and that's fine: your tools are registered with JavaScript. You only need one of the two.
- JavaScript tools: add_topping, manage_pizza, remove_topping, set_pizza_size, set_pizza_style, share_pizza, toggle_layer
- Fail
Tools work when called R3
0/30We couldn't test any tools. Skipped 7: add_topping (not marked read-only); manage_pizza (not marked read-only); remove_topping (not marked read-only); set_pizza_size (not marked read-only); set_pizza_style (not marked read-only); share_pizza (the name suggests it changes something); toggle_layer (not marked read-only)
We only call tools that just read information, so a scan never changes anything on your site. We need at least one of those to check that your tools work.
Fix: Mark tools that only read information with readOnlyHint: true, so we can test them.
annotations: { readOnlyHint: true } // only reads, safe to call- Pass
Tools registered within 5 seconds R4
5/5First tool registered 503ms after the page started loading.
- Within the 5 second limit.
Tool quality
5/15- Fail
Valid input schemas Q1
0/55 of 7 tool(s) have schema problems: • add_topping: no description on topping, size. • manage_pizza: no description on action. • remove_topping: no description on topping. • set_pizza_style: no description on style. • toggle_layer: no description on layer, action.
Agents read the schema to know what to send. A type and a short description on each field help them send the right thing.
Fix: Give every field a type and a short description.
inputSchema: { type: "object", properties: { query: { type: "string", description: "What to search for" }, limit: { type: "integer", description: "How many results to return (default 10)" } }, required: ["query"] }- set_pizza_size: 2 field(s), all described.
- share_pizza: takes no input.
- Pass
Clear descriptions Q2
3/3All 7 tool(s) have a description.
- add_topping: "Add one or more toppings to the pizza"
- manage_pizza: "Manage pizza state"
- remove_topping: "Remove a specific topping from the pizza"
- set_pizza_size: "Set the pizza size directly or infer it based on the number of people."
- set_pizza_style: "Set the style of the pizza (colors/theme)"
- share_pizza: "Get a shareable URL for the current pizza creation"
- toggle_layer: "Control pizza layers (sauce, cheese). Use "add", "remove", or "toggle"."
- Pass
Clear names Q3
2/2All 7 tool name(s) are specific.
- Names: add_topping, manage_pizza, remove_topping, set_pizza_size, set_pizza_style, share_pizza, toggle_layer
- Fail
Read-only hints Q4
0/37 of 7 tool(s) don't say whether they change anything: • add_topping: readOnlyHint isn't set. • manage_pizza: readOnlyHint isn't set. • remove_topping: readOnlyHint isn't set. • set_pizza_size: readOnlyHint isn't set. • set_pizza_style: readOnlyHint isn't set. • share_pizza: readOnlyHint isn't set. • toggle_layer: readOnlyHint isn't set.
readOnlyHint tells agents whether a tool only reads information or changes something. Agents can use read-only tools freely and check with the user before the rest.
Fix: Set readOnlyHint on every tool: true if it only reads, false if it changes something.
annotations: { readOnlyHint: true, untrustedContentHint: true // optional: results include text from users or other sites }- Not assessed
Result size Q5
0/2No tool returned a result, so this wasn't checked.
Fix: Get a tool returning results first (see R3).
Ready for visitors
25/25- Pass
HTTPS with a valid certificate P1
5/5The page uses HTTPS with a valid certificate.
- Connected to googlechromelabs.github.io over HTTPS.
- Issuer: Let's Encrypt
- Valid until: Oct 31 23:38:01 2026 GMT
- Pass
Origin trial token P2
15/15Found an origin trial token in a meta tag, so Chrome turns WebMCP on for your visitors.
- Token: AkSy8NN0hHVbV1Tcto9+K2cDotMP5NcgNobK+M8bhWqrxefn6KOq0cpv/Glx… (212 chars total)
- Pass
No errors blocking tools P3
5/5No errors stopped your tools from registering.
- No Content-Security-Policy header.
Scan details
- Requested
- https://googlechromelabs.github.io/webmcp-tools/demos/pizza-maker/
- Final URL
- https://googlechromelabs.github.io/webmcp-tools/demos/pizza-maker/
- HTTP status
- 200
- Page title
- WebMCP zaMaker!
- Load time
- 1289ms
- Total scan time
- 4138ms
- User agent
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36