MachineRead terminal-window signal markA stylized terminal window with a green signal scan-line and two data marks, indicating machine-readable signal inspection.MachineReadAI & search readiness audit

Blog

A WebMCP manifest is not a working tool

Separate WebMCP discovery documents from browser tool registration, and use an authorized browser test to check the advertised interaction.

author
published
reading
4 min

A page can advertise a tool without providing enough evidence to show that the tool works. A JSON description might survive a redesign even after the corresponding form or script has changed. For someone inspecting the site, the description is a place to begin testing.

MachineRead's WebMCP finding concerns that initial discovery step. Browser support, runtime registration, and an authorized invocation need separate checks. Treating them as one result would conceal exactly where an integration stops working.

The source status is still experimental

The current WebMCP specification describes JavaScript-based tools for AI agents, but it also states that it is published by the Web Machine Learning Community Group and is "not a W3C Standard nor is it on the W3C Standards Track" (Web Machine Learning Community Group, "WebMCP Specification"). That is not a reason to ignore the work. It is a reason to label claims correctly.

The specification's declarative section is even narrower. Its "Declarative WebMCP" section is marked TODO and points readers to a separate Declarative API explainer (Web Machine Learning Community Group, "WebMCP Specification"). The explainer describes a proposed form-attribute vocabulary, including toolautosubmit, but still leaves exact input-schema synthesis as TBD (webmachinelearning, "Declarative API Explainer").

A manifest does not run the tool

The older imperative WebMCP proposal discusses manifest discovery as a possible future iteration. It says agents would still need to navigate to the site to use its tools (Web Machine Learning Community Group, "WebMCP API Proposal"). A candidate manifest URL should therefore not be described as a required WebMCP endpoint.

The repository README illustrates runtime tool registration through JavaScript (webmachinelearning, "README"). Reading that code and observing a registered tool in a supporting browser are different tests. A stale script, unsupported API, or registration error can leave the published description disconnected from the working page.

What MachineRead checks

When the WebMCP family is in scope, MachineRead inspects applicable HTML forms for declarative evidence inside the scored Semantic HTML & Agent Navigation row. It checks tool names and descriptions, named controls, parameter context, duplicate tool names, and whether any toolautosubmit declaration is attached to a safe interaction. Candidate /.well-known/webmcp.json and /.well-known/webmcp responses remain discovery evidence, not proof of a working tool, and do not create a second scored row.

MachineRead also marks its own public audit form as one declarative tool named run_machineread_audit. It is review-gated: the form does not declare toolautosubmit, and submission still uses the same bounded public audit path. That self-description does not invoke a target site's tool or prove browser support.

MachineRead's strict readiness summary withholds the stronger conclusion. WebMCP runtime registration and invocation require browser instrumentation and are not evaluated by the deterministic audit. That caveat stays attached to every WebMCP finding.

How to read a WebMCP finding

Identify the artifact first. A manifest, proposed form markup, and JavaScript registration code require different follow-up. Note the proposal or implementation version it targets; do not assume every example found online describes the same interface.

Then, in an authorized test environment, open the page with a supporting browser and inspect the registered tool. Compare its inputs with the form or operation it controls. Test a harmless case and check that the result matches what happened on the page. A registration observation alone does not demonstrate successful invocation.

MachineRead does not perform that browser workflow. Its finding evaluates bounded markup and discovery evidence; authorized browser testing determines whether the advertised interaction is actually available.

Works Cited

Web Machine Learning Community Group. "WebMCP API Proposal." WebMCP, https://webmachinelearning.github.io/webmcp/docs/proposal.html. Accessed 9 Sept. 2026.

Web Machine Learning Community Group. "WebMCP Specification." WebMCP, https://webmachinelearning.github.io/webmcp/. Accessed 9 Sept. 2026.

webmachinelearning. "Declarative API Explainer." GitHub, https://github.com/webmachinelearning/webmcp/blob/main/declarative-api-explainer.md. Accessed 9 Sept. 2026.

webmachinelearning. "README." GitHub, https://github.com/webmachinelearning/webmcp/blob/main/README.md. Accessed 9 Sept. 2026.

See also