Re: [w3ctag/design-reviews] Incubation: WebMCP (Issue #1238)

Idan-Levin left a comment (w3ctag/design-reviews#1238)

Adding one data point to the question @domfarolino raised around an explicit capability layer vs richer HTML semantics.

Maybe I’m missing something, but I’m struggling to see how a sufficiently rich semantic HTML approach doesn’t eventually converge toward the same capability abstraction as WebMCP.

Take a basic e-commerce site. An agent needs capabilities like `searchProducts`, `selectVariant`, `addToCart`, `getShippingOptions`, `beginCheckout`, etc.

If semantics only help the agent understand the UI, we still keep the expensive loop of reading page state, reasoning over it, acting, waiting for updates, and reading again.

My company recently published a public benchmark comparing WebMCP with page-structure-based browser agents under the same conditions. The UI actuation methods are methods are ~5–10x the tokens and cost per task and 4–5x slower than WebMCP

Benchmark: [https://webmcp\.com/benchmarks](https://webmcp/.com/benchmarks)
Raw results: [https://github\.com/nekuda\-ai/WindTunnel](https://github/.com/nekuda/-ai/WindTunnel)

Better semantics can reduce the cost of understanding the UI, but they don’t remove the cost of actuating it. A direct capability call collapses much of that loop into deterministic execution and our benchmark shows that empirically (WebMCP is remarkably effective in % tasks completed, costs and speed).  

Now let's say we enrich HTML enough to expose actions with names, typed inputs, outputs, side effects, and invocation semantics, aren’t we effectively rebuilding a capability layer inside HTML? 

Which brings me to the security angle of exposing the capacities as semantics. If the agent needs to consume more untrusted page content to discover and execute actions, that potentially increases the prompt-injection surface. Plenty of research already shows how vulnerable web agents are to malicious instructions embedded in page content:

[https://arxiv\.org/abs/2504\.18575](https://arxiv/.org/abs/2504/.18575)

A dedicated interface gives us one clear place to control what agents can access and do, and to monitor what happens.

So I don’t think the question is semantic HTML vs WebMCP. If semantics remain UI semantics, we retain much of the cost and brittleness of UI actuation. If they become expressive enough to describe arbitrary executable capabilities, we are effectively recreating a capability layer inside the DOM but less secure and more costly.

That is essentially what WebMCP is trying to provide, just as an explicit interface.


-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/1238#issuecomment-5338890083
You are receiving this because you are subscribed to this thread.

Message ID: <w3ctag/design-reviews/issues/1238/5338890083@github.com>