WebMCP documentation

When you are signed in on a plan that includes WebMCP, every page on launchto.win registers 3 tools with document.modelContext. An AI agent running in your browser can discover and call them. The calls run in the page with your own session, so the agent can only do what you could do, and only here.

What is WebMCP?

WebMCP is a proposed web standard, developed in the W3C Web Machine Learning community group, that lets a web page register tools for AI agents. A tool is a named JavaScript function with a description and a JSON schema for its input. The page registers it with document.modelContext; an agent running in the browser lists the tools, reads the schemas, and calls the ones it needs. It is the web-page side of the Model Context Protocol: the same tool shape MCP uses between a model and a server, but living in the page and running with the signed-in user's own session.

That last part is the point. An agent using WebMCP does not need an API key, a separate server or a scraped DOM. It uses the site the way you would, with your permissions, and the site decides exactly what it exposes. On launchto.win the tools expose your launch packages, so an agent can read a product's name, descriptions at every length, logo, screenshots and pricing, and fill a directory's submission form from them.

Enable it

WebMCP is a W3C community group proposal and support is early. launchto.win has joined the Chrome and Edge origin trial, so a current Chrome or Edge exposes the API on this site without any flags. For a local build, or a browser outside the trial, enable the testing flag.

To enable the testing flag in Chrome or Edge, open chrome://flags/#enable-webmcp-testing, set it to Enabled and restart the browser. Then sign in here on Maker or Shipaholic. The tools register on the next page load.

Verify it

To check from the console on any launchto.win page, list the registered tools. You should see list-packages, get-package, create-package.

(await (document.modelContext ?? navigator.modelContext).getTools()).map(t => t.name)

Older previews without getTools still register through provideContext; in that case window.__l2wWebmcp.tools lists what launchto.win registered.

Tool reference

Each tool is a named function with a description and a JSON Schema for its input, the same shape as a tool in the Model Context Protocol. The result is an MCP tool result: one text content item holding the JSON body, with isError set when the request did not succeed.

{}

{
  "packages": [
    {
      "name": "Acme Analytics",
      "slug": "acme-analytics",
      "url": "https://acme.example",
      "tagline": "Product analytics for indie SaaS",
      "completeness": 92,
      "created_at": "2026-08-14T09:12:00Z"
    },
    {
      "name": "Draftly",
      "slug": "draftly",
      "url": "https://draftly.example",
      "tagline": "Write release notes from your commits",
      "completeness": 64,
      "created_at": "2026-09-01T16:40:00Z"
    }
  ],
  "count": 2,
  "package_limit": 5,
  "can_create_package": true
}

{
  "slug": "acme-analytics"
}

{
  "name": "Acme Analytics",
  "url": "https://acme.example",
  "tagline": "Product analytics for indie SaaS",
  "pricing_model": "freemium",
  "platforms": [
    "web",
    "api"
  ]
}

Package document

get-package and create-package return the package document, schema version 1.0. It is the same JSON the Chrome extension consumes, so an agent and the extension always see identical data. The example below is generated through the real serializer.

{
  "schema_version": "1.0",
  "name": "Acme Analytics",
  "slug": "acme-analytics",
  "url": "https://acme.example",
  "tagline": "Product analytics for indie SaaS",
  "descriptions": {
    "short": "Privacy-friendly product analytics you can set up in an afternoon.",
    "medium": "Acme Analytics shows indie SaaS teams which features get used and where people drop off, without cookies or a data team. One script tag, dashboards on day one.",
    "long": "Acme Analytics is product analytics for small SaaS teams. Add one script tag and you get funnels, retention and feature usage for every plan, with no cookie banner because no personal data is stored. It replaces a spreadsheet of Mixpanel exports for teams of one to ten."
  },
  "screenshots": [
    "https://launchto.win/rails/active_storage/blobs/proxy/…/dashboard.png"
  ],
  "categories": [
    "Analytics",
    "Developer tools"
  ],
  "keywords": [
    "analytics",
    "product analytics",
    "privacy",
    "saas"
  ],
  "pricing": {
    "model": "freemium",
    "amount": 19.0,
    "currency": "USD",
    "period": "month",
    "display": "Freemium — from $19 / month"
  },
  "platforms": [
    "web",
    "api"
  ],
  "launch_date": "2026-09-15",
  "maker": {
    "name": "Jamie Doe",
    "bio": "Solo developer shipping small SaaS tools since 2019."
  },
  "alternative_to": "Mixpanel",
  "links": {
    "twitter": "https://x.com/acmeanalytics",
    "github": "https://github.com/acme/analytics"
  },
  "generated_at": "2026-09-04T10:00:00Z",
  "logo": "https://launchto.win/rails/active_storage/blobs/proxy/…/logo.png"
}

Errors and limits

Errors are JSON with an error string an agent can show the user. Validation errors add details; an invalid pricing model adds the accepted values. The MCP result carries the same body with isError: true.

Limits are the plan's: Maker allows 5 packages, Shipaholic has no cap. list-packages reports the limit and whether another package can be created, so an agent can check before calling create-package. There is no separate rate limit beyond the site's normal request throttling.

Prompts that work

Agents differ, but these produce good results with a capable in-browser agent. Keep the launchto.win tab open in the same browser, signed in.

Two habits help. Ask the agent to stop before submit; nearly every directory wants a human on that button. And go directory by directory rather than product by product, so the agent stays on one form layout. The agent guide walks through the full workflow.

Security model

• Registered only while signed in on an eligible plan. Signed-out visitors and Free plan accounts have no tools registered, so there is nothing for an agent to call.
• Session and CSRF, no API tokens. The tools call session-authenticated JSON endpoints under /webmcp with the page's CSRF token. There is no long-lived credential to leak.
• Same origin only. Tools are registered without the spec's exposedTo option, so they are visible only to agents on launchto.win pages, never to another site or an embedded frame.
• Scoped to the account. Every endpoint reads and writes the signed-in user's own packages. A slug belonging to someone else returns 404.
• Read and create, not delete. There is no tool to edit or delete a package. Anything an agent creates is visible in your dashboard and can be edited or removed there.
• The agent is yours. WebMCP does not send data to Launch to Win's servers beyond the requests above. Which agent runs in your browser, and what it does with the results, is between you and that agent.

Changelog

WebMCP moves quickly. Every change to the tools, the endpoints or how they are registered is recorded here.

2026-09-09

Documentation gained a plain-language "What is WebMCP?" section and a FAQ; no tool changes.

2026-09-04

Tools are now registered on document.modelContext, following the spec's move away from navigator.modelContext; the old name is still tried as a fallback. Chrome origin trial token added. Tool definitions moved to one shared registry and this documentation published.

2026-09-03

WebMCP shipped: list-packages, get-package and create-package on Maker and Shipaholic plans.

Specification: https://webmachinelearning.github.io/webmcp/. Questions or an agent that does not work as documented: contact us.