Vercel mcp-handler WebMCP: Authenticated Browser Tools Without Client OAuth
Vercel announced on September 18, 2026 that mcp-handler 2.2.0 has experimental WebMCP support for exposing selected MCP tools to in-browser agents. Existing MCP tools are not automatically published to the page: developers opt specific tool names into experimental_webMcp, load the generated script from the MCP endpoint with ?webmcp-script, and the script proxies allowed calls back to the MCP server as the signed-in user. That removes the need for a separate browser-side OAuth flow for those authenticated tools, but it does not remove application authentication, resource authorization, input validation, action approval or audit requirements. Treat WebMCP as experimental and keep the exposed tool set narrower than the server's full MCP catalog.
A web app already has an MCP endpoint and wants an in-browser agent to discover a small subset of those tools
A team assumes adding the WebMCP script will expose every registered MCP tool automatically
An authenticated MCP action works on the server but the browser agent needs to reuse the existing application session
A developer is considering exposing create, update, delete or other consequential MCP actions directly to browser agents without a second authorization review
A production team needs to know whether mcp-handler WebMCP support is stable or still experimental
Possible causes
mcp-handler 2.2.0 can register an explicitly selected subset of MCP tools with the page through experimental WebMCP support
The generated WebMCP script sends selected tool calls back to the existing MCP server using the signed-in user's application context
Browser discoverability and server authorization are different boundaries: a discoverable tool still needs permission checks for the requested resource and action
The feature is experimental, so API shape and browser-agent compatibility can change
HOW TO FIX IT
Work from the safest step to the harder repair.
Step 1. Upgrade only after reviewing the mcp-handler 2.2.0 release and current documentation. Keep the version pinned according to the application's normal dependency policy.
Step 2. Inventory the MCP server's full tool catalog and choose the minimum browser-visible subset. Add only those tool names to experimental_webMcp; do not mirror the entire server catalog merely because the integration can do so.
Step 3. Load the generated WebMCP script from the same MCP endpoint using the documented ?webmcp-script path. Confirm the script is served from the intended application origin and deployment.
Step 4. Keep application authentication on the MCP endpoint. Vercel says the page proxy calls the MCP server as the signed-in user; verify an anonymous browser cannot inherit an authenticated tool context.
Step 5. Authorize every tool action on the server against the authenticated user and target resource. A valid session proves identity, not permission to modify another user's or tenant's records.
Step 6. Validate and normalize tool inputs at the trusted execution boundary. A browser-agent tool schema can improve invocation quality but is not a substitute for server-side validation, ownership checks, rate limits or business rules.
Step 7. Keep consequential tools behind an explicit approval or confirmation step where the product requires it. Browser-side agent discovery must not silently convert read access into permission to create, update, delete, send, purchase or publish.
Step 8. Test with at least two ordinary user accounts plus an unauthenticated session. Swap resource identifiers, use stale sessions, repeat calls and submit malformed inputs to prove that authorization stays bound to the correct user and target.
Step 9. Keep secrets and privileged credentials server-side. Do not put API keys, session tokens, internal service credentials or sensitive tool results into the WebMCP script, public tool descriptions or browser logs.
Step 10. Add audit events for high-impact calls without recording secret payloads. Preserve actor identity, action, target, time and outcome so an agent-triggered change can be reviewed and reversed where appropriate.
Step 11. Treat experimental status as a deployment constraint. Run the normal typecheck, tests, security review and rollback plan before production use, and recheck mcp-handler documentation before relying on the interface as a long-term browser standard.
Need the actual code? Go to GenesisCodeDoctor.com to search the Code Store or request code for the exact platform, error, and repair you are working on.
1. Does the action need browser-agent discovery? If no, leave it server-only rather than expanding the browser-visible surface.
2. Is the tool read-only and low impact? If yes, it may be a reasonable early WebMCP candidate after normal authorization checks.
3. Does the tool modify, delete, send, spend, publish or change permissions? If yes, require explicit server authorization and an appropriate user-approval boundary before exposure.
4. Can two authenticated users reach each other's target object by changing an identifier? If yes, stop deployment and fix resource authorization.
5. Can the same workflow succeed without exposing a secret to the page? If no, redesign the server boundary rather than shipping the secret.
REPAIR FLOW
A visual path from symptom to verified production.
Observe→
Protect→
Isolate→
Repair→
Test→
Publish→
Verify live
BEFORE YOU PASTE CODE
Protect the working site first.
Run negative authorization tests with two different users and intentionally swapped resource identifiers.
Verify anonymous and expired-session calls fail closed at the MCP endpoint.
Keep a narrow experimental_webMcp allowlist and a rollback path that can remove browser exposure without disabling the underlying server MCP endpoint.
STOP AND GET HELP WHEN
Do not turn a repair into a larger outage.
Do not expose the whole MCP server tool catalog to WebMCP by default.
Do not interpret 'as the signed-in user' as permission to skip resource-level authorization or tenant checks.
Do not move server secrets or provider credentials into the generated browser script.
Do not let an in-browser agent perform destructive or financial actions solely because the tool is discoverable.
Do not describe mcp-handler WebMCP support as stable or a finalized web standard while Vercel labels the integration experimental.
HOW GENESIS HANDLES IT
Diagnose the exact failure before choosing a repair.
Genesis separates the visible symptom from the underlying technical cause. Run the supported diagnostic first, review the evidence, and then use a matching repair only when the failure is actually verified.
Does mcp-handler expose every MCP tool to WebMCP automatically?
No. Vercel's September 18 example opts selected tool names into the experimental_webMcp configuration.
Why does the browser not need a separate OAuth flow?
Vercel says the generated page script proxies selected calls back to the MCP server as the signed-in user. That reuses the application's authenticated server path; it does not eliminate server authorization.
Is WebMCP production-stable in mcp-handler 2.2.0?
Vercel labels the support experimental. Production teams should treat the interface as changeable and keep rollout reversible.
Can I expose an admin tool if the page requires login?
Login is not enough. The MCP endpoint still needs role and resource authorization for the specific action and target, plus approval controls where the action is consequential.
How is this different from the WordPress Playground WebMCP guide?
The WordPress guide focuses on Playground's nested-iframe proxy and WordPress Abilities. This guide covers mcp-handler's explicit tool allowlist and signed-in-user server proxy for web applications. The common rule is that agent discoverability never replaces authorization.
Start with a free diagnostic. If Genesis verifies a problem and a compatible treatment exists, continue to the matching Code Store product or repair path. If you cannot find the exact code you need, request it at GenesisCodeDoctor.com rather than forcing a generic snippet into the wrong platform.
