WebMCP: Let AI Agents Complete Tasks on Your Website

Three waves of AI acquisition have landed so far. Wave one was search engine optimization: rank pages, win the click. Wave two was answer engines: get your brand cited inside AI-generated answers. Wave three is stranger, and it is already running: AI agents that operate your website. They read the page, pick the right form, fill it in, and submit. The task completes on your site while their human does something else entirely.

The buying half of this is measurable. Checkout.com's June 2026 merchant survey puts AI agents at roughly 3% of transactions, with 89% of merchants saying they are actively preparing for agentic commerce. What almost nobody has priced in yet is that the same shift is arriving for everything that happens before the buy: the research, the comparison, the "get me a quote", the signup. An agent that can complete those tasks on your site hands its user a finished request. An agent that cannot moves on to the next result, and you never even see the bounce.

What WebMCP actually is

WebMCP is a proposed web standard developed in the W3C Web Machine Learning Community Group. Chrome's own documentation describes it as a proposed standard for building and exposing structured tools for AI agents, and Chrome ships an early preview of it today.

The standard has two halves. The imperative half is a JavaScript API: your code registers functions an agent can call, like exposing an SDK inside the browser. The declarative half is plainer, and it is the half you can ship this week. It is attributes on the HTML you already serve. data-mcp-action names the task a form completes.data-mcp-params describes the field list. data-mcp-param labels each input. A regular browser ignores every one of these attributes, which means zero behavioral change for human visitors. An AI agent reads them like a menu.

What we shipped on our own site

We practice what this post preaches. ChargeGuard has two money forms: the signup at /signup, and the free chargeback risk audit at /chargeback-audit. Both carry the declarative markup now. Each form declares its action (create-account, request-chargeback-audit), a one-sentence description of what submission does, and the parameters. Each field declares its name and constraints: the password rules, the allowed platform values, which checkbox must be true before the form will submit.

Discovery matters as much as markup. An agent landing on a homepage has no way to know these capabilities exist unless you tell it, so we publish a machine-readable catalog at /mcp-actions.json listing both actions with their endpoints and parameter types. The page head carries a link rel="mcp-actions" pointing at the catalog, and our llms.txt has an agent actions section that says the same thing in prose. Three doors, one catalog.

One detail worth copying: both forms run a Cloudflare Turnstile check before submit. That is legitimate protection on money forms, and pretending it is not there would only produce failed agent attempts. So we document it in the catalog and in llms.txt: agents should expect the challenge. The audit itself needs no account. Guest access is the point. An agent whose user asked for a chargeback audit should not have to invent an email and a password to deliver one.

1. Placeholder-only forms

A form whose only hint is placeholder text inside the input makes every consumer guess, human or machine. Real label elements tied to inputs with for and id parse everywhere, help screen readers, and give an agent a field name it can trust. Every input on our two money forms has one.

2. An account required before the task

If the only path to a quote or an audit runs through signup, the agent's user ends up holding an account they never asked for. Guest flows win the task. Keep the account for the work that genuinely needs one, like a dashboard.

3. Undocumented CAPTCHA on the first interaction

Anti-bot protection on a money form is defensible. Anti-bot that no machine-readable catalog mentions is a dead end: the agent submits, the check fails, and your site gets reported as broken. If you run one, say so where agents can read it.

4. Custom widgets with no native input underneath

A dropdown assembled from divs, a date picker drawn in canvas: an agent that fills forms through the DOM sees nothing it can set. Native inputs and native selects parse in every environment an agent will run in. Style them, do not replace them.

What this has to do with chargebacks

Two connections, both commercial. The first: agent-placed orders are becoming a chargeback surface of their own. When a verified agent buys on a cardholder's behalf and the human disputes the charge later, the evidence trail looks nothing like a normal order. We covered the protocol side in the Visa TAP and Mastercard Verifiable Intent evidence playbook and in the seven-check agent readiness audit, both on this blog.

The second is lead flow. When a merchant tells an assistant "find me chargeback protection", the assistant that can complete an audit form delivers a finished request instead of a link to click. The form an agent cannot parse loses silently. There is no bounce rate to warn you, because the visit never registered as a visit in the first place.

The 20-minute check

Run this against your own marketing site. None of it needs a framework migration.

1. Fetch your form page with curl, JavaScript off, and confirm the labels exist in the raw HTML. That response is what an agent sees.

2. Publish mcp-actions.json describing your one to three money actions: what each does, where it posts, which fields are required.

3. Add a link rel="mcp-actions" tag to your head pointing at the catalog.

4. Annotate the forms: data-mcp-action on the form, data-mcp-param and a short data-mcp-description on each field.

5. Replace placeholder-only fields with real labels, and swap custom widgets for native inputs where an equivalent exists.

6. Make sure at least one lead path works without an account, and document any CAPTCHA in the catalog instead of springing it.

7. Test it the way the traffic will arrive: ask a browsing AI assistant to complete the flow end to end, and watch where it stalls.

None of this is heavy engineering. The attributes took an afternoon, including the audit of both forms. The catalog took an hour. The gap it closes is the one wave-three acquisition runs through: assistants that finish the task on your site are the ones that hand you the customer.

If you want to see an agent-completable flow in production, point your assistant at our free chargeback audit and watch it file the request, or fill it in yourself the old way. Either way you get the same two-page report: your estimated exposure, the three costliest gaps, and the fixes to apply first.