WebMCP in the ChatGPT browser: sites hand agents their own tools

A website can now tell an agent what it is allowed to do there. OpenAI switched on WebMCP support in ChatGPT's built-in browser: a page registers its own JavaScript functions as tools — with a name, a description and an input schema — and the model calls them directly instead of guessing its way through the interface. When a page exposes tools, an arrow shows up in the address bar; close the tab and the tools go with it.

WebMCP is an experimental open standard, not an OpenAI product. Support currently lives in ChatGPT Work and Codex with WebMCP enabled, and it requires GPT-5.6 Sol or Terra; Luna has it turned off, and Enterprise and Edu workspaces have no access. Typical uses: searching documents, editing files, working through dashboards, comparing options, updating a shopping cart. Search Engine Journal has the full breakdown.

What matters for site owners:

• ChatGPT asks the user for permission before it acts on a site;
• purchases, data deletion, account changes, sending messages and sharing personal information all need explicit confirmation;
• OpenAI openly warns about prompt injection and data exfiltration through these tools;
• rankings, citations and visibility in answers are untouched for now — this is an action layer, not a results layer.

The trajectory is not hard to read. Agents started by reading sites, then began clicking on the user's behalf, and now sites hand them a list of actions themselves. Give it a year or two and «does checkout work from an agent?» becomes as ordinary a question as «do we have a mobile version?». The winners will be the teams that describe their key flows in machine-readable form early and test them against prompt injection. The losers will be the ones whose actions only exist inside a fragile front end: the agent will not find them, and it will take the customer somewhere it can.