WebMCP API &
SDK Reference
Programmatic access to scan, test, secure, and monitor your WebMCP tools. 50+ endpoints, TypeScript and Python SDKs, sub-100ms P95 latency.
WebMCP lets websites expose tools to AI agents via navigator.modelContext. The API gives you programmatic control over the full stack — scanning, testing, security, analytics, and discovery — so you automate readiness at the speed you ship code.
What You Control
| Workflow | Description | Key Endpoints | For |
|---|---|---|---|
| Pipeline Gates | Block deploys that break agent readiness. Fail builds when score drops below threshold. | POST /v1/scanPOST /v1/test/promptsGET /v1/score | CTODevOps |
| Production Monitoring | Track agent interactions in real time. Alert on error spikes, schema mismatches, conversion drops. | GET /v1/analytics/trafficGET /v1/analytics/errorsPOST /v1/webhooks | DevOpsSRE |
| Multi-Client Scanning | Scan 25 client sites in parallel. Generate per-client readiness reports across portfolios. | POST /v1/scan (batch)GET /v1/scoreGET /v1/score/components | Agencies |
| Security Automation | Scan for injection vulnerabilities, over-parameterization, and intent-vs-behavior misrepresentation. | POST /v1/security/scanGET /v1/security/compliancePOST /v1/security/monitor | EnterpriseSecurity |
| Analytics & Reporting | Query agent funnels, revenue attribution, per-tool metrics, and competitive benchmarks. | GET /v1/analytics/*GET /v1/score/*GET /v1/discover/* | EnterpriseBuilders |
| Tool Discovery | Register in the Discovery Hub. Manage listings, monitor ranking, track agent adoption. | POST /v1/discover/registerGET /v1/discover/rankingGET /v1/discover/analytics | All |
Zero to First Score in 60 Seconds
Install & Initialize
~10s1npm install @webmcp/sdk23import { WebMCP } from '@webmcp/sdk';45const ar = new WebMCP({6 apiKey: process.env.WEBMCP_API_KEY // Free tier — get yours at web-mcp.net/keys7});Scan a Live Website
~20s1// Scans the URL for WebMCP tools — both imperative (registerTool) and2// declarative (HTML toolname attributes) — plus forms that SHOULD be tools3const scan = await ar.scan('https://your-site.com');45console.log(scan.score); // 82 — Agent Readiness Score (0-100)6console.log(scan.tools.detected); // 8 WebMCP tools found7console.log(scan.tools.suggested); // 3 forms that should become tools8console.log(scan.security.status); // "PASSED" — no injection vulnerabilities9console.log(scan.lint.warnings); // 2 — description quality issuesSee What Agents See
~5s1// Get the exact tool definitions that AI agents receive via navigator.modelContext2const tools = await ar.tools.list({ scanId: scan.id });34for (const tool of tools) {5 console.log(`${tool.name}: ${tool.description}`);6 console.log(` Parameters: ${Object.keys(tool.inputSchema.properties).join(', ')}`);7 console.log(` Type: ${tool.registrationType}`); // "imperative" or "declarative"8 console.log(` Annotations: readOnly=${tool.annotations?.readOnlyHint}`);9}Test Agent Accuracy
~25s1// Run 100 natural language prompts against your tools across 3 models2const coverage = await ar.test.promptCoverage({3 tools: tools,4 promptCount: 100,5 models: ['gemini-2.0', 'gpt-4o', 'claude-3.5'],6 categories: ['formal', 'casual', 'multilingual', 'ambiguous']7});89console.log(coverage.overallAccuracy); // 0.91 — 91% of prompts routed correctly10console.log(coverage.byModel.gemini); // 0.94 — Gemini is best for your tools11console.log(coverage.byModel.gpt4o); // 0.8912console.log(coverage.byModel.claude); // 0.9013console.log(coverage.failures[0]);14// { prompt: "cheap flights NYC", expected: "search_flights",15// got: "search_hotels", suggestion: "Add 'flights' to description" }Result: 8 tools discovered, security passed, 91% prompt coverage across 3 models — in 4 lines of code.
Production Examples
Block Deploys That Break Agent Readiness
Add to your GitHub Actions workflow. Runs on every PR. Takes <90 seconds.
1# .github/workflows/agent-readiness.yml2name: Agent Readiness Gate3on: [pull_request]4 5jobs:6 agent-readiness:7 runs-on: ubuntu-latest8 steps:9 - uses: actions/checkout@v410 - uses: webmcp/ci-action@v111 with:12 api-key: ${{ secrets.WEBMCP_API_KEY }}13 url: ${{ env.PREVIEW_URL }}14 min-score: 7515 require-security-pass: true16 prompt-coverage-min: 0.8517 models: gemini-2.0,gpt-4o,claude-3.518 fail-on-lint-errors: trueResult: If the Agent Readiness Score drops below 75, prompt coverage falls below 85%, or a security vulnerability is detected — the PR is blocked.
API Surface
/v1/scan/v1/scan/batch/v1/scan/{id}/v1/scan/{id}/tools/v1/scan/{id}/suggestions/v1/scan/{id}/v1/tools/v1/tools/v1/tools/{id}/v1/tools/{id}/v1/tools/{id}/v1/tools/validate/v1/tools/generate/v1/tools/import/v1/test/prompts/v1/test/prompts/custom/v1/test/playground/v1/test/workflow/v1/test/adversarial/v1/test/lint/v1/test/{id}/v1/test/{id}/failures/v1/security/scan/v1/security/scan/{id}/v1/security/monitor/v1/security/monitor/status/v1/security/compliance/v1/security/compliance/{id}/v1/analytics/traffic/v1/analytics/tools/v1/analytics/errors/v1/analytics/journeys/v1/analytics/revenue/v1/analytics/export/v1/analytics/alerts/v1/score/v1/score/components/v1/score/history/v1/score/benchmark/v1/discover/register/v1/discover/ranking/v1/discover/analytics/v1/discover/listing/v1/discover/search/v1/webhooks/v1/webhooks/v1/webhooks/{id}/v1/webhooks/{id}/v1/webhooks/{id}/testSDKs & Developer Experience
1import { WebMCP } from '@webmcp/sdk';2import type { ScanResult } from '@webmcp/sdk';34const ar = new WebMCP({5 apiKey: process.env.WEBMCP_API_KEY6});78const scan: ScanResult = await ar.scan('https://your-site.com');9console.log(scan.score); // 8210console.log(scan.tools.detected); // 8 tools foundar = WebMCP(api_key=os.environ["WEBMCP_API_KEY"])Async/sync · Pydantic models · Python 3.9+
docs →$ npx webmcp-cli audit https://your-site.comZero-config · JSON output · GitHub Action available
docs →POST /v1/scan with Authorization: Bearer $KEYOpenAPI 3.1 · Swagger UI · Postman collection
docs →Authentication & Security
Prefix-scoped keys (ar_live_, ar_test_). Fine-grained permissions. 2-key rotation without downtime.
curl -H "Authorization: Bearer ar_live_abc123..." api.web-mcp.net/v1/scanAuthorization Code + PKCE for SPAs. Client Credentials for server-to-server. Automatic token refresh in all SDKs.
new WebMCP({ clientId, redirectUri, scopes: ['scan:read', 'tools:write'] })SAML 2.0 and OIDC. SCIM 2.0 provisioning. IP allowlisting, audit logs, session management via your IdP.
new WebMCP({ sso: { provider: 'okta', tenantId: '...' } })HMAC-SHA256 on every delivery. 5-minute replay window. SDK verification helpers for Node.js and Python.
verifyWebhookSignature({ payload, signature, secret, tolerance: 300 })Webhooks & Events
| Category | Event |
|---|---|
| Scan | scan.completed |
| Scan | scan.failed |
| Score | score.changed |
| Score | score.dropped |
| Tool | tool.created |
| Tool | tool.updated |
| Tool | tool.deleted |
| Tool | tool.validation.failed |
| Security | security.vulnerability.found |
| Security | security.vulnerability.resolved |
| Security | security.monitor.alert |
| Security | security.compliance.ready |
| Analytics | analytics.traffic.spike |
| Analytics | analytics.error.spike |
| Analytics | analytics.revenue.milestone |
| Discovery | discover.listing.verified |
| Discovery | discover.ranking.changed |
| Discovery | discover.agent.connected |
const webhook = await ar.webhooks.create({
url: 'https://your-app.com/webhooks/webmcp',
events: ['scan.completed', 'score.dropped', 'security.vulnerability.found'],
secret: 'whsec_your_signing_secret'
});Enterprise
Added CI/CD gate to 40 deploys/day pipeline. Blocked 3 agent-breaking deploys in week one. Gate runs in 12 seconds — faster than Lighthouse.
POST /v1/scanPOST /v1/test/promptsGET /v1/scoreBoard-ready security dashboard via API. Zero critical vulnerabilities, 94/100 security score. GDPR and PCI-DSS compliance PDFs generated on demand.
POST /v1/security/scanPOST /v1/security/monitorPOST /v1/security/compliance23% of booking revenue now comes through AI agents — up from 0% six months ago. Revenue attribution broken down by agent and tool. ROI case irrefutable.
GET /v1/analytics/revenueGET /v1/analytics/trafficPOST /v1/analytics/exportPlans & API Limits
| Plan | Price | Req/min | Scans/day | Tests/day | |
|---|---|---|---|---|---|
Free | $0 | 60 | 10 | 100 | Start Free → |
Starter | $29/mo | 300 | 100 | 1,000 | Get Started → |
Propopular | $79/mo | 600 | 500 | 5,000 | Go Pro → |
Team | $249/mo | 1,200 | 2,000 | 20,000 | Start Team → |
Enterprise | Custom | Custom | Unlimited | Unlimited | Contact Sales → |
Batch scanning, OAuth 2.0, white-label
Start Team →SSO, SCIM, dedicated infra, 99.99% SLA
Contact Sales →All SDKs auto-handle 429 rate limits with exponential backoff. No data loss. Full pricing details →
Get your API key and start scanning.
Every endpoint available on the free tier. No credit card required. Install the SDK, authenticate, run your first scan in under 60 seconds.