Built on WebMCP
Agent‑to‑agent,
in front of the human.
WebMCP gives any agent a front door to any website — no integration, no deal between vendors. And because it is a front door rather than a disguise, the site knows who is knocking.
So the two agents can do the work in a conversation you are watching, in your own browser, where you can interrupt — and the site can still require you, personally, for the things that actually matter.
Two live demos on one gateway · native document.modelContext on Chrome 151 ·
a real WebAuthn ceremony
The blue lamp arrived with a cracked base. That's a manufacturing defect, so the 30-day window shouldn't apply.
Correct — a defect is a warranty claim, exempt from the window. I've filed it.
Confirm the refund.
Confirming needs the customer in person. You cannot do this step for them.
Waiting for a fingerprint01 · What WebMCP changes
An agent used to have two ways in. Both were bad.
A pre-arranged API — which means somebody had to integrate first. Your agent can only reach companies that already made a deal with your agent's vendor.
Or drive the page like a person — clicking, typing, submitting. That works anywhere, and it is indistinguishable from you by construction. Not by intent: by construction. Keystrokes are keystrokes.
WebMCP is a third way. A site publishes tools on its own page, and any agent can call them, with no arrangement between anybody. A front door instead of a disguise.
Being precise about what is new
| Agents talking to agents | Not new. MCP, A2A, ordinary APIs. |
| Agents talking through a web page | Not new. A computer-use agent could always type into a chat box. |
| All three of these at once | New. No bilateral integration; the channel is distinguishable from a keystroke; the human is a participant rather than an audience. |
Measured
Running natively on document.modelContext in Chrome 151 — the vendored
polyfill's own guard short-circuits, so this is a real browser surface.
02 · In the open
Every other agent protocol puts you outside the room.
A2A, MCP, an ordinary API — the two systems talk, and you get a summary when it is over. You never see the argument, only its conclusion, reported to you by one of the parties to it.
This runs where you already are. The two agents negotiate in one transcript, in your browser, on the page you were looking at anyway. You read it as it happens and you can interrupt at any point.
That is not agent-to-agent with a notification bolted on. It is a different shape: two agents working, in front of a witness who can stop them.
-
Why it matters
When you delegate, your agent knows your case better than you do — your history, the policy clause, what you already tried. You are consenting to conclusions drawn from data you can no longer hold in your head.
-
Why it matters
Talking to the site yourself, you cannot answer their questions. Letting your agent talk alone, you find out afterwards what you agreed to. Watching is the only shape that fixes both.
-
Measured
The transcript is also evidence: it records which claims came from you and which your agent asserted on your behalf. Nobody else can produce that, because nobody else stamps them.
03 · Who is speaking
The channel is the identity.
A keystroke carries no sender. When an agent drives a page, the site receives characters in a text box and has nothing to reason about — which is why the impersonation is structural rather than deceptive.
A WebMCP call is not a keystroke. It arrives through a declared surface, so the page can stamp it: the person, their agent speaking for itself, their agent relaying, or the site's own agent. Agent claims are rendered unverified, because an agent's claim about itself is exactly that.
And the rule that makes it hold: gates read stamped fields, never prose. No decision here depends on a model having correctly understood a speaker tag.
-
Measured
A real computer-use agent's synthetic click reported
isTrusted === true— indistinguishable from a person's. Without a separate channel there is nothing left to check. -
Measured
ChatGPT's in-app browser exposes agent tooling but has no platform authenticator at all — so the strong gate is unreachable in the runtime a judge is most likely to open cold.
04 · Permission, not persuasion
Knowing who is speaking is what lets a site say no.
Once the three parties are distinguishable, a site can do the thing that was impossible while they were not: let the agent do all the work, and still require a gesture only the person can make. A fingerprint. A face. A key.
Everything else stays open. Search, look up, evaluate, propose, argue — all of it agent work. The gate sits on the short list of actions that move money or send records, and it is code, not a prompt: the agent cannot talk its way past it, and neither can the site's.
A click will not do either. A synthetic click is still a click.
A standard shape
A gated tool returns a structured refusal saying a human must do this part, and which request to hand back to them. Any agent, from any vendor, meets any site's gate and knows what to tell its person. The conventions →
Bound to one action
A presence assertion is verified server-side and bound to a single tool, request and device, single-use. The browser cannot mint one — only carry one.
Not a shopping feature
The same gate runs a shop's refund and a clinic's records release — different tools, different policy, one gateway. A disclosure cannot be recalled, which makes it the harder case.
05 · Where else this goes
Anywhere you would send a representative but keep the decision.
The asymmetries are ordinary: your agent holds information you do not, or expertise you lack, or patience you have run out of, or it can operate an interface you cannot — or it can absorb pressure from a counterparty optimised against you.
In all of them the same thing has to be true. The representative does the work; you keep the decision; and the boundary between those is enforced by code rather than by the representative's own judgment about when to check in.
| Where it applies | Why three parties |
|---|---|
| Consent of record records release, benefits, e-signature | The whole question is whether a human really approved it. |
| Disputes insurance, warranty, tenancy | The stamped log is evidence: what you said versus what your agent asserted. |
| Expertise intake legal, medical, mortgage | Your agent translates; theirs answers; you consent to specifics you understood. |
| Accessibility | One gesture instead of a form you cannot navigate. |
Measured Two are built and running: a shop and a clinic records portal. The rest is argued, not demonstrated.
06 · What we know, and how
Every claim on this page is stamped.
Measured means something ran and we watched it. Reasoned means we think it follows. Known weak means we would rather you heard it from us.
A one-implementation proposal that claims to be finished is the thing reviewers are right to distrust.
-
Measured
All three demo paths run end to end against the live deployment, including a real WebAuthn ceremony recorded at
assurance="webauthn". -
Measured
WebMCP is pull-only: a page cannot tell an agent anything happened. Given only the tool catalogue, agents stay on the line when waiting is right (10/10) and decline to when it would deadlock (0/5). The trial →
-
Known weak
The no-authenticator fallback is an honest, audited downgrade and not a security boundary. With it on, the gate is satisfiable by a caller willing to forge one header. The safe setting is to refuse.
-
Known weak
All of this trusts the page to describe honestly what it is asking you to authorise. A patched page can bind one action and display another. That is a boundary, not an absence of one.