Web → WebMCP, automatically

Turn any website's APIs into agent-callable tools.

Web2MCP watches the requests a site makes as you browse, learns their shape, and injects them into the page as native WebMCP tools an in-browser AI agent can call.

Install the extension See how it works

Requires a browser with WebMCP — Chrome 149+ with --enable-features=WebMCP, or a Chromium build that ships it. Works without it too, in record-only mode.

How it works

Browse the site. The tools build themselves.

No config, no schema files, no per-endpoint wiring. Web2MCP learns a site's API surface from the traffic it already produces.

1

Record

A page-context script patches fetch and XMLHttpRequest, capturing every JSON API the site calls — its own backend and third-party APIs alike — while filtering out static assets and trackers.

2

Aggregate

Requests are deduped into endpoint templates (/users/123 → /users/{id}), with JSON Schemas and required-ness inferred across observations. Everything a site touches pools under one domain.

3

Inject

Each endpoint registers as a native WebMCP tool via document.modelContext. Calls replay in page context, so cookies and captured auth headers just work.

Features

Built for the messy reality of real web apps.

Captures everything, including third-party

Every JSON call the page makes — to its own backend or any other domain — is recorded and pooled under the site you're on.

Templating & schema inference

IDs, UUIDs and GraphQL query hashes collapse into {params}; query and body schemas are inferred from what it sees.

Native WebMCP injection

Tools register through the browser's own modelContext API — discoverable by any in-browser agent or the DevTools WebMCP panel.

One pool per website

Subdomains and pages share a single tool set keyed by the site's domain, so tools accumulate as you move around the app.

Session-param auto-fill

Opaque session tokens an agent can't know (like Yahoo's crumb) are filled from the recorded value when left blank.

Full visibility & control

A toolbar badge counts the tools on a page, the popup lists them (including the site's own WebMCP tools), and you can disable injection per site.

No magic, no hype

Where it shines — and where it can't.

Web2MCP replays the requests a page actually makes. That's powerful for most sites, and honestly limited for hardened ones. Here's the real boundary.

Works great

  • Cookie-authenticated apps — internal tools, dashboards, most B2B SaaS.
  • Static bearer tokens sent directly in the request.
  • Read endpoints (GET) across a huge range of sites.
  • Session tokens in params — auto-filled from recordings.
  • Your own products, where you control the API.

Can't replay

  • Service-worker-injected auth that the page's own fetch never sees.
  • One-time anti-replay tokens (per-request nonces) that expire after a single use.
  • Request-body signatures recomputed client-side per payload — changing an argument invalidates them.

Install

Add it in seconds.

Web2MCP
Chrome Web Store
Add to Chrome
Free · No account · Works in Chrome & Edge
  1. Use a WebMCP-capable browser

    Chrome 149+ with WebMCP enabled, or any Chromium browser that ships it. Without it, Web2MCP still records — tools activate once WebMCP is available.

  2. Add to Chrome

    Install Web2MCP from the Chrome Web Store — one click, no account, nothing to configure.

  3. Browse normally

    Use any site as usual. The toolbar badge counts the tools as the site's APIs are captured and injected.

  4. Let your agent use them

    Any in-browser WebMCP agent can now discover and call the site's tools on your behalf.

Give your browser agent a site's whole API.

Open source, runs entirely on your machine, and stores everything locally. No accounts, no servers.

Install the extension See how it works