OpenAI has added WebMCP-based site tools to the built-in browser in the ChatGPT desktop app. For teams that automate workflows, run commerce sites or build web apps, that simple change matters: it lets websites expose explicit, structured actions—search documents, update carts, edit files—that ChatGPT (and Codex) can call directly instead of faking clicks and typed input.

How site tools work

WebMCP lets a webpage register JavaScript functions as tools, each with a name, description and a structured input schema. When a page exposes tools, ChatGPT’s desktop browser shows an arrow in the address bar to indicate availability and whether a tool can only read data or can also make changes.

When ChatGPT finds a matching tool, the tool remains linked to the open page for that session and disappears when the page closes. OpenAI highlights typical uses such as searching documents, exploring dashboards, comparing travel options and updating shopping-cart contents.

Availability and developer access

OpenAI calls WebMCP an experimental open standard; the specification referenced is a draft from the W3C Web Machine Learning Community Group and is not on the W3C Standards Track. Site tools are available in the ChatGPT desktop app’s built-in browser when enabled for an account and when the webpage implements WebMCP.

According to OpenAI’s documentation, the feature requires GPT-5.6 Sol or Terra; GPT-5.6 Luna has WebMCP disabled. Site tools are not available in Enterprise or Edu workspaces. The capability depends on rollout and page support: it does not work in Chrome via the ChatGPT extension unless developers enable an experimental flag or join Chrome’s origin trial. Embedded content may not expose tools, and tools registered on one page do not automatically appear on other pages unless those pages register them too.

Security and trust controls

Because site tools can operate within a signed-in session and change website data, OpenAI asks for explicit permission before ChatGPT interacts with a site and requires additional confirmations for sensitive actions—purchases, account changes, deleting data, sending messages or sharing personal information.

OpenAI warns about risks such as data exfiltration and prompt injection. Each tool invocation undergoes a safety review, but OpenAI cautions that those checks do not guarantee a website or its responses are trustworthy. Chrome guidance has previously flagged malicious tool descriptions and contaminated outputs as prompt-injection risks for browser-based agents.

Why this matters for marketers and developers

WebMCP shifts control from agents guessing user flows to sites explicitly defining how agents can interact with application logic. For commerce teams, that increases reliability when automating tasks like comparing offers or updating a cart. For publishers and SaaS providers, it offers a way to surface existing permissions and business logic to agents instead of relying on brittle UI simulations.

That control also creates trade-offs. Exposing structured actions can improve automation quality but widens the attack surface for data exfiltration and prompt-injection attacks if permissions, descriptions or input schemas are poorly designed. The draft specification and OpenAI’s docs do not address potential impacts on search rankings, citations or discoverability, so SEO teams should watch implementations closely.

Practical next steps

  • Audit goals: decide which user actions you want agents to perform and why. Limit tool exposure to the minimal set required.
  • Design clear schemas: use minimal, well-documented input schemas and precise descriptions to reduce ambiguity and prompt-injection risks.
  • Enforce permissions and confirmations: require explicit user consent for sensitive operations and log confirmations for auditing.
  • Test early and locally: developers can test in the ChatGPT desktop app where available or use Chrome’s experimental flag/origin trial for local testing.
  • Threat-model the surface: include prompt injection, data exfiltration and contaminated outputs in your security review and monitoring plan.

What to watch

Track two signals. First: broader availability across account types and browsers—wider rollout will determine how practical WebMCP is for production workflows. Second: early site implementations from major publishers, e-commerce platforms or SaaS vendors that demonstrate how structured tools change agent behavior in real-world tasks.

If you manage a site that handles authenticated actions or customer data, start planning now. Implementing WebMCP is not simply a developer task: it touches product design, permissions, help copy and security. Done well, it reduces brittle automation; done poorly, it introduces new risks.