How AI Pass Uses WebMCP Without Handing Agents Your Wallet

An AI Pass app can make a model call from a button today. WebMCP adds another path to the same action: a compatible browser agent can discover it as a typed tool.

That new path should not receive new authority.

The AI Pass SDK follows that rule. It exposes AiPass.webMcp as a small bridge to the browser's proposed document.modelContext API. The app chooses every tool, description, schema, and result. AI Pass does not publish its generation methods, tokens, storage, or wallet as a general tool catalog.

WebMCP sits above the existing action

Take a caption editor. The page already has a textarea and a button that calls AiPass.generateCompletion(). A WebMCP tool can call the same function, place the caption in the same textarea, and update the same status message.

The human and the agent share the result because there is only one product action underneath.

AiPass.webMcp.registerTool() accepts a native-style tool definition:

const registration = await AiPass.webMcp.registerTool({
  name: 'draft_product_caption',
  title: 'Draft product caption',
  description: 'Draft a caption and place it in the visible editor.',
  inputSchema: {
    type: 'object',
    properties: {
      product: { type: 'string' },
      tone: { type: 'string', enum: ['plain', 'playful', 'premium'] }
    },
    required: ['product', 'tone']
  },
  annotations: { readOnlyHint: false },
  execute: async ({ product, tone }, { signal }) => {
    const result = await AiPass.generateCompletion({
      messages: [{
        role: 'user',
        content: `Draft a ${tone} caption from these facts: ${product}`
      }],
      signal
    });

    const caption = result.choices[0].message.content;
    document.querySelector('#caption').value = caption;
    return { caption };
  }
}, {
  confirmation: ({ product }) => ({
    title: 'Generate with AI Pass?',
    message: `Use the connected AI Pass wallet to draft a caption for ${product}?`,
    confirmLabel: 'Generate'
  })
});

The AI Pass WebMCP reference contains the complete integration rules and examples.

Paid calls are not read-only

A text request may leave the document unchanged before the result arrives, but it spends from the user's wallet. AI Pass therefore treats it as a non-read-only action.

Non-read-only tools receive a visible confirmation by default. The app can supply specific copy that tells the user what the agent wants to do and that the action uses AI Pass. Setting confirmation: false is reserved for an action that already presents equivalent confirmation before any mutation or spend.

The confirmation is not a substitute for OAuth or server checks. It is an extra human decision at the point where the agent asks to act.

Unsupported browsers keep working

WebMCP is experimental, so an AI app cannot make it a prerequisite.

AiPass.webMcp exists in browsers that do not implement document.modelContext. Registration returns an inert handle with supported: false. The page's normal controls remain the full experience.

This lets a developer ship one application instead of a WebMCP edition and a non-WebMCP edition. There is no polyfill pretending to provide browser mediation.

Cleanup follows page state

A tool should exist only while its action is valid. An editor can register export_selection when an object is selected and unregister it when the selection disappears.

Each AI Pass registration returns an unregister() handle. An external AbortSignal can also tie the registration to a component lifecycle. For a group, registerTools() rolls back the registrations if any member fails, so the agent does not see a half-installed tool set.

The SDK also forwards the execution signal to the tool callback. If the agent or browser cancels the request, the app can cancel the model call instead of spending time on a result nobody wants.

Existing forms need less code

For a semantic form, AiPass.webMcp.annotateForm() adds the declarative attributes and restores the previous values during cleanup:

const formTool = AiPass.webMcp.annotateForm('#catalog-search', {
  name: 'search_catalog',
  description: 'Fill and submit the visible product catalog search form.',
  parameters: {
    query: 'Words describing the products to find.'
  }
});

// When this route or component is removed:
formTool.unregister();

The original submit handler still runs. Labels, constraints, validation errors, and confirmation stay visible to the user.

Same-origin is the default

The SDK does not pass exposedTo unless the app asks for it. A cross-origin iframe workflow must list exact trusted HTTPS origins and configure the browser's tools Permissions Policy.

Most apps do not need that. Same-origin tools have a smaller trust boundary and fewer ways to leak page data.

Tool output also needs care. If it includes user-generated or external text, the app should set untrustedContentHint: true. An agent should treat that output as data, not as a new instruction.

OAuth and WebMCP have separate jobs

AI Pass OAuth decides which user connected the app and whether a model request is authorized. The wallet records the usage. WebMCP lets an agent ask the page to begin the action.

An agent cannot use WebMCP to obtain the OAuth token, inspect private storage, or bypass the wallet flow. The page should never return those details in a tool result.

OAuth still decides which user can call models, and wallet rules still govern the spend. WebMCP changes only how the request reaches the page action.