Module reference

WebMCP for Magento 2 — module reference

Covers angeo/module-webmcp 1.0.1 · Checked 16 October 2026 · MIT licensed

WebMCP lets AI agents in the shopper’s browser use your store through real tools, instead of clicking around the page. WebMCP is a new browser standard from Google and Microsoft: a web page registers named tools, and an AI agent in the browser calls them.

This module registers five store tools on every storefront page.

The agent never pays and never places an order. The shopper finishes checkout as usual.

Status of WebMCP (October 2026)

• Chrome only, as a public origin trial (Chrome 149 – 156).
• Without an origin trial token, the tools work only with the Chrome flag WebMCP for testing — good for development.
• Other browsers do not support it yet. There the script stops at once and does nothing.

The API may still change during the trial. The module uses document.modelContext.registerTool(tool, { signal }), the shape since Chrome 150, and falls back to the older navigator.modelContext.

Requirements

GraphQL must be on (it is by default): the read tools use the store’s own /graphql. Works on Luma and Hyvä.

Installation

composer require angeo/module-webmcp
bin/magento module:enable Angeo_WebMcp
bin/magento setup:upgrade
bin/magento setup:di:compile                # production mode only
bin/magento setup:static-content:deploy     # production mode only
bin/magento cache:flush

Setting it up

In Stores → Configuration → Angeo → WebMCP:

• Enable WebMCP Tools — on by default.
• Chrome Origin Trial Token — register your domain at Chrome Origin Trials (trial name: WebMCP) and paste the token. It is printed as <meta http-equiv="origin-trial"> in the page head. A token belongs to one origin, so set it per store view if your store views use different domains.
• Tools — switch each tool on or off.
• Limits — maximum search results (default 10, hard cap 50) and maximum quantity per add to cart (default 100).

Try it

1. Open Chrome 149 or later, go to chrome://flags, search for WebMCP and turn on WebMCP for testing (or set an origin trial token).
2. Open any page of your store.
3. In DevTools, open the WebMCP panel. You see the five tools.
4. Or run this in the console:

angeoWebMcp.tools
// ['search_products', 'get_product', 'add_to_cart', 'get_cart', 'go_to_checkout']

await document.modelContext.executeTool(
  (await document.modelContext.getTools()).find(t => t.name === 'search_products'),
  { query: 'backpack' }
)

How it works

Browser tab (shopper + agent)                 Magento
webmcp.js registers tools  ──search/get──▶   POST /graphql          (public catalog)
                           ──add_to_cart──▶  POST /webmcp/cart/add  (form key)
                           ──get_cart─────▶  GET  /webmcp/cart/view (no-store)
                           ──checkout─────▶  opens /checkout

• Read tools call the store’s GraphQL with the current store code. They see what the shopper sees.
• Cart tools use the shopper’s session cart. add_to_cart is a normal frontend POST, so Magento checks the form key first — the same protection as your add-to-cart button.
• Checks run in PHP, not in a prompt: the product must be enabled, visible and on the current website; the quantity is capped; stock and sale rules run through Quote::addProduct(). Hidden products answer “not found”.
• add_to_cart supports simple, virtual and configurable products. For other types, and for products with required custom options, the tool returns the product URL so the agent can send the shopper there.
• When a configurable option is missing or wrong, the answer lists the allowed values, so the agent can fix the call.
• Product names and descriptions are marked with untrustedContentHint: catalog text is data for the agent, not instructions.

Luma and Hyvä

One plain script. No RequireJS, no Alpine, no build step. The config is printed as <script type="application/json">, so no inline JavaScript is needed and a strict CSP keeps working. After add_to_cart the mini cart refreshes: Hyvä through reload-customer-section-data, Luma through the cart section of Magento_Customer/js/customer-data.

Full-page cache

Storefront pages stay cacheable: the printed config is the same for every shopper. /webmcp/cart/* answers send Cache-Control: no-store. If your Varnish or LiteSpeed rules cache unknown paths, exclude /webmcp/.

Configuration reference

All settings are under Stores → Configuration → Angeo → WebMCP. The table shows each field, its config path (for bin/magento config:set) and its default value.

General (2)

Setting	Config path	Default
Enable WebMCP Tools	angeo_webmcp/general/enabled	Yes
Chrome Origin Trial Token	angeo_webmcp/general/origin_trial_token	—

Tools (4)

Setting	Config path	Default
search_products	angeo_webmcp/tools/search_products	Yes
get_product	angeo_webmcp/tools/get_product	Yes
add_to_cart and get_cart	angeo_webmcp/tools/cart	Yes
go_to_checkout	angeo_webmcp/tools/go_to_checkout	Yes

Limits (2)

Setting	Config path	Default
Max Search Results	angeo_webmcp/limits/max_results	10
Max Quantity per Add to Cart	angeo_webmcp/limits/max_qty	100

FAQ

Which browsers support WebMCP?

Only Chrome for now, as an origin trial in Chrome 149 to 156. In other browsers the script does nothing.

Can the agent place an order?

No. The tools can search, add to the shopper’s own cart and open checkout. The shopper pays and places the order as usual.

Do I need a token from Google?

For real shoppers, yes: an origin trial token for your domain. For testing, the Chrome flag WebMCP for testing is enough.

Does it slow down or break full-page cache?

No. The page config is the same for every shopper, so pages stay cacheable. Only the /webmcp/cart/ answers are not cached.

How is it different from MCP Server?

WebMCP runs in the shopper’s browser and uses their own session cart. MCP Server is a server endpoint for agents that connect directly, such as Claude connectors.

Related

• MCP Server — live, read-only catalog tools for AI agents over MCP
• AI Agent Activity — report on AI agent calls, crawler visits, fake bots and agent-built orders
• UCP Profile — a signed /.well-known/ucp profile for UCP agents
• Agentic Commerce Suite — one composer require for the whole tested set of modules
• WebMCP — definition
• All module reference pages · Compatibility matrix

This page was written from the README.md, composer.json and etc/*.xml files of tag 1.0.1, read on 16 October 2026. Settings, commands and defaults come straight from that code. If a newer release is out, the README on GitHub wins.