# WebMCP Polyfill

> WebMCP Polyfill is an officially published WebMCP tool from GoogleChromeLabs. Anomity scores its risk at 10 out of 100 (low).

- **Canonical URL:** https://catalog.anomity.ai/webmcp/webmcp-polyfill
- **Kind:** WebMCP tool
- **Publisher:** GoogleChromeLabs
- **Trust level:** official
- **Risk score:** 10/100 (low)
- **Website:** https://github.com/GoogleChromeLabs/webmcp-polyfill
- **Repository:** https://github.com/GoogleChromeLabs/webmcp-polyfill
- **Last updated:** 2026-09-02
- **JSON:** https://catalog.anomity.ai/api/entries/webmcp/webmcp-polyfill

## Description

The WebMCP Polyfill is a compatibility layer that emulates the experimental WebMCP browser API in browsers that do not yet ship it. WebMCP lets a page declare structured tools — either as annotated HTML forms or as JavaScript functions with JSON schemas — so an AI agent can call them directly instead of guessing at the DOM. The polyfill implements that surface in userland, which is how most sites currently experiment with the API ahead of an origin trial.

The risk to reason about is not the polyfill's own code so much as what it turns on. Once a page registers tools, any agent driving that browser can enumerate and invoke them inside whatever session the user already has open — logged in, cookied, and authorized. A prompt-injected agent that reaches a page with a `submitOrder` or `transferFunds` tool does not need to defeat authentication; the page has already handed it a typed, documented button. Treat every registered tool as an unauthenticated endpoint reachable by anything that can influence the agent's context.

## Why it scored 10

The score starts at the catalog's neutral base of 50 and moves only through the signals below. The formula is published at https://catalog.anomity.ai/about — there is no model and no hidden heuristic.

| Signal | Contribution | Severity | Evidence |
| --- | --- | --- | --- |
| Published by the vendor | -40 | trust offset |  |

Clamped result: **10/100**, band **low**.

## Capabilities

| Capability | Name | Security implication |
| --- | --- | --- |
| `browser:control` | Browser control | Drives a browser session. Combined with credential access can impersonate the user on web services. |
| `network:outbound` | Outbound network | Can make outbound network requests. Required for hosted model providers and remote APIs; also the path for data exfiltration if combined with read access. |

## Related WebMCP tools

- [Latch](https://catalog.anomity.ai/webmcp/latch-webmcp) — risk 40 (medium)
- [Model Context Tool Inspector](https://catalog.anomity.ai/webmcp/model-context-tool-inspector) — risk 40 (medium)
- [nekuda WebMCP Workbench](https://catalog.anomity.ai/webmcp/nekuda-webmcp-workbench) — risk 40 (medium)
- [WebMCP Bridge](https://catalog.anomity.ai/webmcp/webmcp-bridge) — risk 40 (medium)
- [WordLift AI Audit](https://catalog.anomity.ai/webmcp/wordlift-ai-audit) — risk 40 (medium)
- [WebMCP Evals](https://catalog.anomity.ai/webmcp/webmcp-evals) — risk 20 (low)

---

Source: Anomity Catalog (https://catalog.anomity.ai/). Scoring methodology: https://catalog.anomity.ai/about. Machine-readable index: https://catalog.anomity.ai/llms.txt · https://catalog.anomity.ai/openapi.json