Origin WebMCP

How it works

WebMCP is a browser standard (document.modelContext) so agents can call tools on a page instead of scraping. Two parts sit in front of this origin. Same for static /agent pages and the React SPA.

1. Edge inject + origin bridge

Edge or origin adds one line to HTML: a module script at /.webmcp/bridge.js. Cloudflare Dashboard Agent Readiness may also inject it. This origin copy is the fallback so Fly + clawd-bot computers still work.

<script type="module"
        src="/.webmcp/bridge.js"
        data-packs="c2pa,mcp-server-client"
        data-mcp-url="/mcp"></script>

2. Packs

Site MCP Server pack (mcp-server-client) discovers tools via same-origin POST /mcp method tools/list, then proxies tools/call with credentials: same-origin.
Content Credentials pack (c2pa) reads image provenance in the visitor browser. It does not send the image to Cloudflare.

3. document.modelContext.registerTool

The bridge finds document.modelContext. No surface → no-op, page unchanged. With a surface, packs call registerTool with name, description, inputSchema, and execute(args, { signal }). The SPA also registers open_bots and list_desk_pages. Fetch uses AbortSignal.

4. POST /mcp

Public JSON-RPC. No JWT. Read-only tools: health, list_pages, get_page, bots_roster, bots_tape, clawdbot_info. Token-gated desk MCP stays at /api/mcp.

Computer, studio, and premium still need 100,000 $CLAWD. Never print keys.

Start: /llms.txt · /agent/bots.md · /bots