WebMCP is an experimental Chrome feature for structured agent-tool interactions on the web. In practice, that means a browser-controlled workflow can pass typed requests, tool results, and context in a more machine-readable way than a normal page script. Because it is experimental, its exact design and threat model may still change.
From a security perspective, WebMCP matters because new browser capabilities create new attack surface before defenders fully understand them. If an attacker can influence the messages, tool selection, or page context used by an agent, they may steer actions in unintended ways, trigger privilege misuse, or expose sensitive data. Defenders should treat WebMCP like any other emerging browser feature: limit exposure, review permissions, log interactions, and patch quickly when the browser vendor fixes flaws in the feature.