WebMCP’s Cross-Origin Tools Need Three Opt-Ins. Cloudflare’s Backends Differ
Photo: Forkast
A draft can define a careful cross-origin gate without making every browser use that same gate. The WebMCP Community Group draft , dated November 2, 2026, proposes a way for web pages to expose structured tools. It is not a W3C Standard and is not on the W3C Standards Track. For builders, the key distinction is between the draft’s in-page JavaScript access model and the separate way a browser agent may inspect tools. The draft puts WebMCP APIs behind a policy-controlled feature named tools , with a default allowlist of 'self' .
Source: Forkast
