LLamjinLab
AI NewsWords 1592Read time≈ 4 min

OpenAI Adds WebMCP Site Tools to ChatGPT’s Desktop Browser and Sites

OpenAI added WebMCP site tools to ChatGPT’s desktop browser and Sites, letting Codex call structured actions exposed by webpages.

AIOpenAICodexTool Use

OpenAI added support for WebMCP to the ChatGPT desktop app’s built-in browser and ChatGPT Sites on August 25, 2026. On a compatible webpage, ChatGPT Work or Codex can now discover structured actions supplied by the site and use them to complete a task.

The consequential change is how the agent interacts with a website. Conventional browser agents inspect pages and simulate clicks and typing. A WebMCP-enabled site can instead define actions such as searching records, changing a dashboard’s date range, editing a document, or updating a cart. Each action has a name, description, structured input schema, and JavaScript implementation.

This gives developers a browser-native tool surface without requiring visitors to install a separate MCP server. It does not, however, make every website or ChatGPT account compatible. OpenAI describes the feature as a rollout, and WebMCP itself remains an experimental proposal rather than a completed W3C standard.

1. What OpenAI Shipped

OpenAI calls its WebMCP implementation “site tools.” The feature runs in the built-in browser included with the ChatGPT desktop app on macOS and Windows. That browser maintains its own cookies, sign-ins, history, extensions, and other browser state; it does not reuse a person’s Chrome profile.

After opening a supported page, a user can ask ChatGPT Work or Codex to perform a task. The agent examines the tools registered by that page and can select a matching action. No separate connector installation is required.

An indicator in the address bar shows whether the page supplies site tools. Users can inspect the available tools, see whether they read information or make changes, and review recently used tools after a call. The indicator is gray when tools are available and turns blue while ChatGPT is using them.

Access has several explicit restrictions. Users need the latest version of the ChatGPT desktop app and must select GPT-5.6 Sol or GPT-5.6 Terra. OpenAI says GPT-5.6 Luna currently has WebMCP disabled. Site tools are also unavailable in Enterprise and Edu workspaces, and availability depends on the account rollout and the tools offered by the current page.

The release extends a browser strategy OpenAI had already been consolidating inside ChatGPT. In July, TechCrunch reported that OpenAI was retiring its standalone Atlas browser while moving agentic browsing functions into the desktop app and a Chrome extension. WebMCP now gives that built-in browser a structured alternative to visually operating supported websites.

2. How WebMCP Changes Browser Automation

Traditional browser actuation asks an agent to infer what controls mean, decide where to click, enter text, and check whether each step succeeded. Every intermediate decision can fail when labels are ambiguous, page layouts change, or an interface uses controls designed primarily for humans.

WebMCP lets the website declare its capabilities. A page can register a JavaScript tool through document.modelContext.registerTool, providing a tool name, a natural-language description, a JSON Schema for its inputs, optional annotations, and an execution handler. The handler can reuse the same application logic that powers the site’s human interface.

A document editor, for example, could expose separate tools for finding a section, suggesting an edit, and posting a comment. A dashboard could let the agent select a date range and retrieve the data behind a chart. These calls are more explicit than asking the model to identify and manipulate several visual controls in sequence.

The page remains the operational boundary. Tools are discovered only after the agent visits the site, and they use the live page state and its signed-in session. Closing the page or navigating elsewhere can make its tools unavailable. A tool registered by one page does not automatically carry over to another tab or website, and OpenAI does not currently support tools supplied only by embedded content.

If no suitable tool exists, ChatGPT can fall back to its regular browser capabilities. WebMCP therefore acts as a progressive enhancement rather than a replacement for the website’s interface or ordinary browser automation.

WebMCP also differs from the broader Model Context Protocol. An MCP integration connects an AI application to a local or remote server and can operate independently of an open webpage. WebMCP exposes client-side tools associated with the page being viewed. A service can support both approaches: an MCP server for persistent API-level access and WebMCP for collaboration inside its live interface.

Google’s Chrome documentation describes imperative JavaScript tools and declarative annotations for HTML forms. Chrome offers WebMCP through an origin trial beginning with Chrome 149 and through an experimental flag for local development. That is separate from OpenAI’s site-tools implementation and does not mean WebMCP is generally enabled in stable browsers.

3. ChatGPT Sites Becomes a WebMCP Distribution Path

The second part of OpenAI’s release concerns ChatGPT Sites, its public-beta system for generating, hosting, refining, and sharing websites and lightweight applications. Developers can ask Codex to add WebMCP support to an existing app or create a WebMCP-enabled project and deploy it through Sites.

OpenAI recommends beginning with an operation the application already supports, reusing its authentication, authorization, input validation, and internal logic. Developers should give tools narrow input schemas, describe side effects precisely, and return enough information for the agent and user to verify the result. The ordinary interface should remain available for people and browsers without WebMCP support.

Sites is available in public beta for Plus, Pro, Business, Enterprise, and Edu plans, subject to rollout and plan-specific limits. It is unavailable to Free and Go accounts and was not offered in the European Economic Area, Switzerland, or the United Kingdom at launch. Workspace administrators can also restrict creation or public publishing.

Those Sites entitlements should not be confused with the narrower site-tools rollout. Enterprise and Edu users may have access to building and hosting Sites while still being unable to use WebMCP site tools in the desktop browser.

Every Sites deployment URL is a production deployment. OpenAI advises creators to save a version and review it before deploying when they do not want unfinished changes to replace the live version.

OpenAI is supporting the release with a 10-day WebMCP Challenge backed by Google Chrome, Cloudflare, Shopify, Vercel, Render, and Netlify. Registration opened on August 25 at noon Pacific time, with submissions due September 3 at 1 p.m. Pacific. The top 10 entries are scheduled to receive $3,000 each, one year of ChatGPT Pro, a Codex Micro keyboard, OpenAI merchandise, and additional sponsor prizes.

4. Permissions and Security Remain Critical

WebMCP gives webpage code an agent-facing description and callable interface, but those definitions are not inherently trustworthy. OpenAI explicitly treats tool names, descriptions, and results as untrusted content. A tool labeled as read-only, for example, is not automatically proof that its implementation cannot change data.

The built-in browser conducts a safety review before each tool invocation and ties the call to the page and tool registration that supplied it. Normal website-access prompts still apply. Users can also disable site tools through the browser permissions settings.

ChatGPT requires confirmation before sensitive actions such as sharing personal information, making a purchase, deleting data, changing account permissions, or sending a message. Before transmitting sensitive information, it is supposed to identify what will be shared, where it will go, and why. Instructions originating from a webpage cannot independently authorize those actions.

These controls address risks already identified in the WebMCP draft, including prompt injection through tool metadata or outputs, misleading descriptions of side effects, excessive requests for personal attributes, and leakage across sites. The draft notes that authenticated browser sessions can give tools substantial authority, including the ability to purchase products, modify account settings, or delete content.

The standard’s maturity is therefore an important constraint. The WebMCP document dated August 26 is a Community Group Report from the W3C Web Machine Learning Community Group; it is neither a W3C Standard nor on the W3C Standards Track. Parts of the proposal remain under development, and Google says the API is subject to change.

OpenAI has not published latency measurements, task-completion rates, or comparative benchmarks for its implementation. The verified improvement is architectural: compatible sites can replace some inferred UI operations with explicit, schema-defined calls. Its practical value will depend on which websites implement useful tools, how accurately those tools describe their behavior, and whether users’ accounts and selected models support them.

Frequently Asked Questions

What is required to use WebMCP site tools in ChatGPT?

Users need the latest ChatGPT desktop app, access to the rollout, GPT-5.6 Sol or GPT-5.6 Terra, and a webpage that supplies a relevant tool.

Do ChatGPT site tools work in Chrome?

OpenAI’s site-tools feature currently works in the desktop app’s built-in browser, not Chrome. Chrome has a separate experimental WebMCP implementation and origin trial.

Does a website need a separate MCP server?

No. WebMCP tools can run through client-side JavaScript on the open webpage. A developer may still provide a conventional MCP server for integrations that must work without the page being open.

Can a WebMCP tool make purchases or change data?

It can expose write actions, but OpenAI says ChatGPT must request confirmation for sensitive activities such as purchases, deletions, messages, personal-data sharing, and permission changes.

Sources

Share

Share this article