WebMCP’s Cross-Origin Tools Need Three Opt-Ins. Cloudflare’s Backends Differ

A draft can define a careful cross-origin gate without making every browser use that same gate. The WebMCP Community Group draft , dated November 2, 2026, proposes a way for web pages to expose structured tools. It is not a W3C Standard and is not on the W3C Standards Track. For builders, the key distinction is between the draft’s in-page JavaScript access model and the separate way a browser agent may inspect tools. Three gates for in-page access The draft puts WebMCP APIs behind a policy-controlled feature named tools , with a default allowlist of 'self' . This first gate acts as a high-level permission switch: if a page embeds a cross-origin iframe that needs the API, the embedding document must explicitly delegate the feature using allow="tools" .

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Forkast.