Explore with AI
Open this article in an AI assistant, with a prompt that asks it for a summary and the takeaways.
HTMLvault already covers the author's side: AI tools such as Claude or Cursor publish HTML through the HTMLvault MCP server and get back a private, tracked link. WebMCP covers the reader's side. It is a young browser standard, run as a Chrome origin trial, that lets a page register JavaScript tools (document.modelContext.registerTool) so an AI agent in the reader's browser can use the page through declared functions instead of scraping its HTML. HTMLvault registers such tools in two places: on every published link, and on its own pages.
How Agent access works on a published link
Every published page registers three read-only tools for the reader's assistant: one for the page's outline, one for its text, and one for its tables and JSON data blocks. The names are hyphenated and verb-first, such as get-page-overview. Results follow five rules:
- Only what the browser already received. Nothing comes from the link's database record: no dates, expiry, owner or tracking data.
- Rendered text by default. Text the page does not render is left out unless the agent asks for it.
- Marked untrusted. Every result is flagged as untrusted content, because it is the author's text, not HTMLvault's.
- Browser only, and not a view. The tools run in the reader's browser, never on a server. A tool call records nothing and bills nothing.
- Only while content is shown. A password gate, an expired or removed page, a 404 and an error page get no tools.
Agent access is on by default on every plan, Free included, and on anonymous links. On a custom domain or branded subdomain, the tool names carry no htmlvault- prefix and nothing loads from htmlvault.com.
Turning Agent access off for a link
There is nothing to switch on. To turn it off for one link, open /links, open that link's edit form, set the Agent access select to Off and save. The select's help text describes both settings:
On: this page gets read-only tools, so a reader's AI assistant can read its outline, text and tables. Off: HTMLvault adds none.
Off returns the page to exactly what it was before: no tools, no origin-trial token, no marker. The browser does not enforce it. Off stops HTMLvault adding tools, not tools your page's own JavaScript registers, and an assistant can still read the page the way it reads any web page. To control who can open the link at all, use a password or a link expiry window.
Worked example: a prospect's assistant reads a proposal
A sales rep sends a prospect a long proposal as an HTMLvault link: an h2 per section, the fees in a <table id="pricing">, and a JSON data block of deliverables. The prospect opens it in a browser that exposes WebMCP, such as ChatGPT's desktop browser, and asks the assistant to summarize the scope and list the pricing for their budget sheet.
The page has loaded, so its tools are registered. The assistant reads the outline, pulls the text of the sections it needs, and takes the pricing table from the tables tool instead of rebuilding it from scraped markup. Each result arrives marked untrusted, with nothing about the link attached.
The prospect's visit counts as a view, as it always would; the tool calls add nothing. The same tools let an assistant compare two shared pages, such as two versions of a quote. Real headings and real <table> elements give the tools the most to work with.
Tools on HTMLvault's own pages
HTMLvault's own pages register tools as well, so an assistant in your browser can do what the page's buttons do:
- The homepage and
/upload:htmlvault-publish-htmlandhtmlvault-scan-html, for any visitor, with or without an account. /links:htmlvault-list-linksandhtmlvault-get-link-analytics, for the signed-in account.
Each tool calls the same endpoints as the buttons, with the visitor's own session, so every normal rule applies unchanged: rate limits, the Free monthly link limit, expiry caps, the sensitive-data scan and the link-safety checks. Nothing destructive or account-level is offered: no delete, edit, share, settings, keys or billing.
The publish tool never silently drops part of a request. A password or expiry the plan does not allow is refused with the reason and where to get it, and nothing is published. A visitor without an account cannot publish a page the scan flags; a signed-in visitor gets the findings back and publishes only by calling again with an explicit acknowledgment. Every publish answer states the plan limits that applied: when the link expires and why, and on Free, the month's link count.
Limits and browser support
- Browser support is young. ChatGPT's desktop browser is the shipping consumer, and Gemini in Chrome has said it will support WebMCP. Where a browser does not expose the API, HTMLvault's code does nothing and the page behaves as it always has.
- The origin-trial token is host-specific. It is served only on HTMLvault's own share hosts, so stock Chrome exposes the API there. On your own custom domain, the link tools appear only where the reader's browser exposes the API by itself.
- Not access control. Agent access decides what HTMLvault offers an assistant, not who can open the page.