🤖 WebMCP Support & Documentation

1. Getting Started — Your First Audit

Running a WebMCP readiness audit takes less than 30 seconds. Here's how:

2. Understanding Your Audit Results

Your audit report is broken into three categories, each scored out of 100:

Origin Isolation (0–100)

Checks whether your site is properly isolated for AI agent access. This includes:

• HTTPS — Your site must be served over HTTPS
• Origin-Agent-Cluster — Must NOT be set to ?0 (this disables WebMCP)
• Cross-Origin-Opener-Policy (COOP) — Should be set to same-origin
• Permissions-Policy — Should include a tools directive

Schema Readiness (0–100)

Checks whether your site has structured data that AI agents can understand:

• JSON-LD Schema — Structured data (Product, Article, FAQPage, BreadcrumbList)
• llms.txt — A file at /llms.txt describing your site for AI crawlers
• Robots meta — Your page should NOT have noindex
• Sitemap — A /sitemap.xml reference should exist

Form & Tool Readiness (0–100)

Checks whether your forms and tools are declared for AI agent use:

• WebMCP Declarative Tools — toolname attributes on form elements
• WebMCP Imperative API — navigator.modelContext.registerTool() calls
• OpenGraph Tags — At least og:title, og:description, og:image
• Title & Meta Description — Proper page metadata

3. What the Grades Mean

Your overall score is calculated as the average of all three categories. Here's what each grade means:

4. How to Implement WebMCP on Your Site

After your audit, you'll get specific recommendations. Here's how to implement the most common fixes:

Step 1: Add HTTP Security Headers

Add these headers to your web server or CDN configuration:

# Nginx
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Permissions-Policy "tools=(self)" always;

# Apache (.htaccess)
Header set Cross-Origin-Opener-Policy "same-origin"
Header set Permissions-Policy "tools=(self)"

# Cloudflare Workers / Next.js
const headers = {
  'Cross-Origin-Opener-Policy': 'same-origin',
  'Permissions-Policy': 'tools=(self)'
};

Step 2: Add JSON-LD Schema Markup

Add structured data to your HTML section:

For e-commerce sites, add Product schema:

Step 3: Create llms.txt

Create a file at https://yoursite.com/llms.txt describing your site for AI crawlers:

# Your Site Name

> A brief description of what your site does.

## Sections
- Products: https://yoursite.com/products
- About: https://yoursite.com/about
- Contact: https://yoursite.com/contact

Step 4: Declare WebMCP Tools (Declarative)

Add toolname attributes to your form elements so AI agents can discover and use them:

  
  Search

Step 5: Register WebMCP Tools (Imperative)

For dynamic tools, register them via JavaScript:

if (navigator.modelContext) {
  navigator.modelContext.registerTool({
    name: "searchProducts",
    handler: async (input) => {
      const res = await fetch("/search?q=" + input.query);
      return res.json();
    }
  });
}

Step 6: Add OpenGraph Tags

5. HTTP Headers Reference

These headers tell AI agents that your site is safe to interact with:

• Cross-Origin-Opener-Policy: same-origin — Isolates your page from cross-origin openers. Required for WebMCP.
• Permissions-Policy: tools=(self) — Explicitly allows tool declarations on your origin.
• Content-Security-Policy — Ensure your CSP doesn't block inline scripts (needed for JSON-LD and WebMCP tool registration).

6. Schema Markup Guide

JSON-LD is the recommended format for structured data. Here are the most useful schema types:

• Organization — Your company info (name, logo, contact)
• Product — E-commerce product listings with prices
• Article — Blog posts and news articles
• FAQPage — Frequently asked questions
• BreadcrumbList — Site navigation structure
• LocalBusiness — Physical business with address and hours

Validate your schema at validator.schema.org before deploying.

7. Agency Dashboard Guide

If you're an agency managing multiple client sites, the dashboard is your control center.

Logging In

Managing Client Sites

• Add a site: Enter the URL, client name, and client email in the "Add Client Site" form
• Run an audit: Click the 🔍 Audit button on any site — takes ~15 seconds
• Download PDF: Click 📄 PDF to open a branded, printable report (Pro+ only)
• Email report: Click 📧 Email to send the report directly to your client (Pro+ only)
• Remove a site: Click 🗑️ to delete a site and all its audit history

White-Label Branding (Pro & Agency Plans)

On Pro and Agency plans, you can customize your reports:

• Brand Color: Used in the score banner, table headers, and headings in PDF reports
• Logo URL: Your agency logo appears at the top of all PDF reports
• "Powered by" footer: All reports show "Report by [Your Agency] | Powered by Purple Crib Studios"

Team Accounts (Unlimited Plan)

On the Unlimited plan, you can invite up to 10 team members to your agency. Each member gets their own login (email + API key) and can access the same dashboard, run audits, download PDFs, and email reports — all under your agency's branding.

• Invite a member: Go to the "Team Members" section in your dashboard, enter their name, email, and role (Member or Admin), then click "Invite Member"
• Member receives email: The invitee gets a branded email with their login details and a link to the dashboard
• Member logs in: They use their own email + API key (not yours) at the same dashboard URL
• Roles: Admins can add/remove sites and manage branding. Members can run audits, download PDFs, and email reports, but can't add sites or change branding
• Disable a member: Click "Disable" to temporarily revoke access without deleting them — re-enable anytime
• Remove a member: Click "Remove" to permanently delete the team member and revoke their access

8. API Access (Pro & Agency Plans)

Pro and Agency plan subscribers get programmatic access to trigger audits and retrieve scores.

Authentication

Use your agency API key (found in your dashboard after login) in every request:

{
  "agency_id": 2,
  "api_key": "your-api-key-here",
  "action": "dashboard"
}

Available Endpoints

All API calls go to: https://base44.app/api/apps/6a0e1c58a24143fcfcf1d735/functions/webmcp-agency

• action: "login" — Authenticate with email + API key
• action: "dashboard" — Get all sites + reports (scoped to your agency)
• action: "add_site" — Add a client site (URL, client_name, client_email)
• action: "remove_site" — Remove a site (site_id)
• action: "audit_site" — Trigger an audit on a site (site_id)
• action: "update_branding" — Update logo URL + brand color

Example: Trigger an Audit via API

fetch('https://base44.app/api/apps/6a0e1c58a24143fcfcf1d735/functions/webmcp-agency', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    action: 'audit_site',
    agency_id: 2,
    api_key: 'your-key',
    site_id: 7
  })
})
.then(r => r.json())
.then(data => console.log(data.report.overall_score));

9. Troubleshooting & FAQ

10. Contact Support

Still stuck? We're here to help. Reach out and we'll get you sorted:

Our team is available Monday to Friday, 9 AM – 6 PM (WAT). For urgent issues, WhatsApp gets the fastest response.