Sagara Gunathunga

Before AI crashed into our daily life, we had clean, separate interfaces for humans and machines to access resources and tools over the internet. For humans, that interface is a web app, usually built with JavaScript/TypeScript web frameworks. For machines, it's a fixed API, usually built using REST or GraphQL, built for integrations decided in advance.

When agents arrived, the obvious answer was a third interface built just for them, and that is MCP. A small team with a plain JavaScript front end cannot afford to build, operate and maintain another system while the spec itself keeps changing underneath them.

So does every business need to stand up and run its own MCP server to be part of the agentic web? For a large corporation with that scale, a separate team and a separate system just to serve agents makes perfect sense. But what does that mean for small businesses?

Agents do not wait for us. With no MCP server to call, they fall back to browser automation and take over a user's logged in session to get the job done. You are then accountable for whatever the agent does under that session, and most people have no real way to decline.

In this talk I will show how the proposed WebMCP standard lets you extend the application you already run instead of building a second one, and what you can do today while browsers catch up. If you already build your application with a JavaScript or TypeScript framework, you register the tools you want to expose to agents the same way you already implement business logic like shopping cart handling. You do not build a second system, you extend the one you have. Agents authorize through MCP instead of borrowing a user's session, which is the biggest win from a security point of view.