WebMCP - use AlertKick from the agent in your browser

This page is the reference. For a walkthrough of actually using it, see AlertKick in your browser’s agent.

WebMCP is a W3C draft that lets a web page register tools with the browser’s AI agent. The agent calls the tool in the page, in the user’s logged-in session, instead of reading the screen and clicking. AlertKick exposes two WebMCP surfaces:

• The dashboard (https://<team>.alertkick.com) registers the same 35 tools as the hosted MCP connector once you are logged in: list servers, alerts, monitors and heartbeats; create HTTPS, DNS, TCP, domain-expiry and mail-posture (SPF/DMARC/blocklist) monitors; acknowledge and resolve alerts; raise and approve change records.
• The free checkers at alertkick.com/tools each register one read-only tool (check_ssl_certificate, lookup_dns_records, check_domain_expiry, check_security_headers, check_website, check_ip_reputation, check_mail_records for SPF, DMARC, DKIM and blocklist status, and generate_mail_records on the email setup wizard, which writes the MX, SPF, DKIM and DMARC records for the providers you name). No account needed.

Supported browsers

Agent	Status
ChatGPT desktop app (built-in browser)	Works out of the box
Chrome 151	Works out of the box; no flag needed
Chrome 146 to 150	May need chrome://flags/#enable-webmcp-testing
Other browsers	Nothing is registered; the site works as normal

WebMCP needs HTTPS and a top-level tab. Both AlertKick surfaces meet that.

You do not have to guess whether your browser supports it. Open any free tool and read the line above the form:

• WebMCP detected, N tools registered - your browser speaks WebMCP and this page’s tools are registered, so an agent can call them.
• Agent-ready - the browser has no WebMCP support. The page still works normally; nothing is registered.
• WebMCP detected, 0 tools registered - the browser exposes the API but the tools did not register. Reload; if it persists, please tell us.

What it looks like

On a free checker page, no login:

Check the TLS certificate on example.com and tell me when it expires.

Is example.com’s mail set up properly, and are its mail servers on any blacklist?

Generate SPF, DKIM and DMARC records for example.com; we use Google Workspace and SendGrid.

In the dashboard:

Add uptime, DNS and certificate-expiry monitors for example.com, checking every minute.

What is paging right now? Acknowledge the critical ones and open a change window for tonight 22:00 to 23:00 on the web servers.

Safety model

• Read tools (list_*, get_*, the free checkers) carry readOnlyHint: true and run without a prompt.
• Write tools (create_*, acknowledge_alert, resolve_alert, pause_monitor, delete_*, approve_change, …) open an Allow your AI assistant to … dialog showing the exact parameters. Nothing happens until you click Allow. The agent is paused for the duration through requestUserInteraction().
• Tools are registered when you log in and removed when you log out. A tab that is not signed in exposes nothing.
• Every call goes through the normal /api/v1 endpoints with your session, so tenant scope, roles and plan limits apply exactly as they do when you click.

Tool list

The dashboard tool names and input schemas are identical to the hosted MCP connector; see the tool table there. The manifest is generated from the MCP server, so the two cannot drift.

For developers

The WebMCP layer is open source (MIT): github.com/alertkick/alertkick-webmcp. It contains the generated tool manifest, the browser adapters, and a small registerPageTool() helper for adding a read-only tool to any page. The README covers testing with navigator.modelContextTesting in Chrome.

To check what a page has registered in Chrome with the flag enabled:

await navigator.modelContextTesting.getTools();
await navigator.modelContextTesting.executeTool('list_alerts', { status: 'open' });