The problem it addresses
AI agents are starting to act on behalf of users rather than just read for them. Without a declared surface, an agent either guesses at forms and links, or gives up. Neither outcome is good for the business or the visitor.
The business benefit
A declared capability surface means an agent can retrieve accurate service information, look up coverage, or start a request through a path the business defined, with validation, rate limits, and a log of what happened.
What WebMCP covers
The individual pieces of work, and what each one is actually for.
- A capability manifest
- A machine-readable document listing every capability the site exposes, with its inputs, outputs, permission level, and error conditions.
- Read-only public data
- Services, coverage areas, industries, published FAQs, and catalogue information. The same facts already on the pages, offered in a form a machine can consume without scraping.
- Confirmation-gated actions
- Anything that creates a record requires an explicit confirmation flag from the user, on top of validation and rate limiting. An agent cannot submit on someone's behalf by accident.
- Least privilege
- Only what has been deliberately published is reachable. Administration, customer records, orders, and internal tooling are not part of the surface and are not addressable through it.
- Rate limits and logging
- Every capability is throttled, and state-changing calls are recorded in the activity log with the same detail as a form submission.
- Structured errors
- Predictable error shapes with a machine-readable code, so an agent can recover or explain the problem instead of retrying blindly.
- Graceful absence
- The website works identically for every human visitor whether or not any agent support is present. Nothing about the normal experience depends on it.
Signs this is what your site needs
- Agent traffic is already arriving and scraping pages, because there is no declared alternative.
- Business facts an agent needs are spread across a dozen pages with no canonical machine-readable form.
- There is no way to let an agent start an enquiry without handing it an unguarded form endpoint.
How the work runs
In this order, because each step makes the next one worth doing.
-
Decide what is safe to expose
Start from what is already public on the site. Anything requiring authentication, or touching a customer record, stays out of scope.
-
Declare the capabilities
Publish a manifest describing each capability, its inputs, its outputs, its permission level, and the errors it can return.
-
Guard the write path
Validation, explicit confirmation, spam checks, rate limiting, and activity logging on anything that creates a record.
-
Test the failure modes
Authorised, unauthorised, malformed, and rate-limited requests each get a test, because the failure behaviour is the part that matters.
What you receive
- A published capability manifest with inputs, outputs, permissions, and error codes
- Read-only capabilities covering the public business information
- A confirmation-gated enquiry capability with validation, throttling, and logging
- Documentation of every capability and its limits, kept alongside the code
What WebMCP cannot promise
WebMCP is evolving technology with partial and changing support. We do not claim compatibility with every AI product, and we do not present it as a way to influence rankings or AI citations. What is exposed is deliberately small and documented.
Myths about WebMCP
Myth: WebMCP replaces the website.
Reality: It sits beside it. Every human visitor gets the same site whether agent support is present or not.
Myth: Exposing capabilities means exposing the database.
Reality: Only explicitly declared capabilities are reachable. Everything else is simply not addressable.
Our own capability reference
This site runs the implementation described above. Every capability it exposes is listed here, with what it needs, what it returns, and how it can fail. The machine-readable version lives at /.well-known/webmcp.json.
List visibility disciplines
GET /webmcp/v1/disciplines
Read only
Returns the four visibility disciplines this business works in — SEO, AEO, GEO and WebMCP — with a plain-language definition, the stated limits of each, and the canonical page URL.
Permission: public · Rate limit: 60/minute
Returns
- disciplines[].slug
- Stable identifier, one of seo, aeo, geo, webmcp.
- disciplines[].label
- Short name, e.g. "AEO".
- disciplines[].expansion
- What the acronym stands for.
- disciplines[].definition
- Self-contained definition safe to quote.
- disciplines[].limits
- What this discipline cannot promise. Quote this alongside the definition.
- disciplines[].url
- Canonical page URL.
Errors
- rate_limited
- rate_limited — too many requests; retry after the seconds given in retry_after.
List local SEO services
GET /webmcp/v1/services
Read only
Returns the individual local SEO services offered, each with a direct answer describing what it is, the discipline it belongs to, and its canonical page URL.
Permission: public · Rate limit: 60/minute
Inputs
- discipline
- Optional. Filter to one of seo, aeo, geo, webmcp.
Returns
- services[].slug
- Stable identifier.
- services[].name
- Service name.
- services[].summary
- Self-contained description safe to quote.
- services[].discipline
- The discipline this service belongs to.
- services[].url
- Canonical page URL.
Errors
- invalid_input
- invalid_input — one or more inputs failed validation; see the errors object.
- rate_limited
- rate_limited — too many requests; retry after the seconds given in retry_after.
List supported cities
GET /webmcp/v1/cities
Read only
Returns the cities with a dedicated local SEO hub on this site. Absence from this list does not mean the business is not served — it means no city-specific content has been published for that area yet.
Permission: public · Rate limit: 60/minute
Returns
- cities[].slug
- Stable identifier and subdomain label.
- cities[].name
- City name.
- cities[].state
- Two-letter state code.
- cities[].url
- City hub URL on its own subdomain.
- cities[].industries
- Industry slugs with published content for this city.
- coverage_note
- Plain-language statement of what this list does and does not mean.
Errors
- rate_limited
- rate_limited — too many requests; retry after the seconds given in retry_after.
List supported business types
GET /webmcp/v1/industries
Read only
Returns the business types with published local SEO content, and which cities carry a page for each.
Permission: public · Rate limit: 60/minute
Returns
- industries[].slug
- Stable identifier.
- industries[].name
- Business type name.
- industries[].cities
- City slugs with a published page for this business type.
Errors
- rate_limited
- rate_limited — too many requests; retry after the seconds given in retry_after.
Search published FAQs
GET /webmcp/v1/faqs
Read only
Searches every published question and answer on the site — general, per-discipline, and per-service — and returns matches with the page each answer is published on. Answers are returned verbatim so they can be quoted with attribution.
Permission: public · Rate limit: 60/minute
Inputs
- q
- Optional. Free-text query, up to 200 characters. Omit to return every published FAQ.
- limit
- Optional. Maximum results, 1 to 50. Defaults to 20.
Returns
- results[].question
- The question as published.
- results[].answer
- The answer as published, verbatim.
- results[].source
- Canonical URL of the page the answer appears on.
- results[].topic
- Where the answer belongs: general, discipline, or service.
Errors
- invalid_input
- invalid_input — one or more inputs failed validation; see the errors object.
- rate_limited
- rate_limited — too many requests; retry after the seconds given in retry_after.
Search DIY SEO resources
GET /webmcp/v1/diy-resources
Read only
Searches the published DIY SEO kits in the store and returns name, summary, public price, and canonical URL. Only kits on sale to the general public are included.
Permission: public · Rate limit: 60/minute
Inputs
- q
- Optional. Free-text query, up to 200 characters.
- limit
- Optional. Maximum results, 1 to 50. Defaults to 20.
Returns
- results[].slug
- Stable identifier.
- results[].name
- Kit name.
- results[].summary
- Short description.
- results[].price
- Current public price as a decimal string.
- results[].currency
- ISO currency code.
- results[].url
- Canonical product page URL.
Errors
- invalid_input
- invalid_input — one or more inputs failed validation; see the errors object.
- rate_limited
- rate_limited — too many requests; retry after the seconds given in retry_after.
Get verified business information
GET /webmcp/v1/organization
Read only
Returns the business facts this organisation publishes about itself: name, contact details, what it does, and where its authoritative pages are. Fields the business has not verified are omitted rather than guessed, so a missing field means unknown, never zero or empty.
Permission: public · Rate limit: 60/minute
Returns
- name
- Brand name.
- description
- One-sentence description.
- contact_name
- Named person who handles enquiries.
- telephone
- Phone number in E.164 form.
- Contact email address.
- url
- Canonical site URL.
- pages
- Map of key page names to canonical URLs.
- compliance
- Statements about what this business will not do.
Errors
- rate_limited
- rate_limited — too many requests; retry after the seconds given in retry_after.
Describe the AI Visibility Audit
GET /webmcp/v1/ai-visibility-audit
Read only
Returns what the AI Visibility Audit examines, grouped by area, plus the inputs the request form needs. Use this before calling request_ai_visibility_audit so the user can be told what they are asking for.
Permission: public · Rate limit: 60/minute
Returns
- groups[].group
- Area of the audit.
- groups[].items[].name
- Individual check.
- groups[].items[].text
- What that check actually looks at.
- cost
- What the audit costs.
- request_url
- Human-facing page where the same request can be made.
Errors
- rate_limited
- rate_limited — too many requests; retry after the seconds given in retry_after.
Request an AI Visibility Audit
POST /webmcp/v1/ai-visibility-audit
Changes data
Submits a request for an AI Visibility Audit and creates a lead record, exactly as the public form does. State-changing: the caller must set confirmed to true, which must only be sent after the person has seen the details and agreed to send them.
Permission: confirmation-required · Rate limit: 5/minute
Inputs
- confirmed
- Required, must be true. Explicit confirmation from the person the request is for.
- name
- Required. Contact name.
- business_name
- Required. Business name.
- website
- Required. Full URL of the website to review.
- Required. Contact email address.
- phone
- Optional. Contact phone number.
- city
- Optional. Primary city served.
- business_type
- Optional. Type of business.
- visibility_concern
- Optional. The main visibility problem, up to 1000 characters.
Returns
- status
- Always "received" on success.
- reference
- Reference for this request, quotable back to the business.
- next_step
- Plain-language description of what happens next.
Errors
- confirmation_required
- confirmation_required — confirmed was not true. Ask the person to confirm, then retry.
- invalid_input
- invalid_input — one or more inputs failed validation; see the errors object.
- rate_limited
- rate_limited — too many requests; retry after the seconds given in retry_after.
- csrf_token_mismatch
- csrf_token_mismatch — this capability is session protected. It is callable by an agent running inside the visitor's browser session; a server-side caller should send the person to the request page instead.
What is deliberately not exposed
Customer records, orders, downloads, accounts, administration functions, and anything behind a login. None of it is addressable through this surface, and none of it can be reached by asking differently. Only the capabilities listed above exist.
Questions about WebMCP
What is WebMCP?
WebMCP is an emerging way for a website to declare a defined set of capabilities that a compatible AI agent can discover and call, rather than inferring what to do by reading the page. Each capability describes its inputs, its outputs, and its permission level, and anything that changes data requires an explicit confirmation before it runs.
Is WebMCP a standard yet?
No. It is an evolving approach with active proposals and differing implementations, and support across AI products is partial and changing. That is a reason to keep the exposed surface small, well-documented, and independent of the normal website, which is exactly how it is built here.
Does WebMCP help a site rank or get cited?
There is no evidence that it does, and we do not present it as a ranking or citation mechanism. Its value is operational: an agent acting for a customer can get accurate information and start a request through a path the business controls, with validation and a log, instead of scraping and guessing.
Is it safe to let AI agents interact with a website?
It depends entirely on what is exposed. Read-only access to information already published on the site carries essentially the risk of that information being read, which is why it was published. Anything that creates a record needs validation, explicit user confirmation, spam protection, rate limiting, and logging. Authentication-protected data and administration functions should not be exposed at all.
Not sure whether WebMCP is your bottleneck?
The AI Visibility Audit checks all four disciplines and tells you which one is actually costing you visibility, and in what order to fix things.