# In-browser AI agents (WebMCP)

> Yes. Tick Also allow in-browser AI agents (WebMCP) when you pair a tab, and your browser's own AI agent gets the same DiceyTable tools and rules.

- Question: Can my browser's built-in AI agent use DiceyTable?
- Source: https://diceytable.com/docs/ai-agents/setup/webmcp
- Last verified: 2026-10-13

Yes. When you pair a tab, tick **Also allow in-browser AI agents (WebMCP)**, and an AI agent built into your browser
can use that tab's DiceyTable tools. It follows the same rules as the agent in your AI app.

WebMCP is a new web standard, still in early trials. It lets a web page offer tools to an AI agent that lives in the
browser itself or in a browser extension. Regular MCP works differently: your AI app starts a helper program, the
DiceyTable bridge, and talks to it. [What is MCP?](https://diceytable.com/docs/ai-agents/concepts/what-is-mcp) explains the regular kind.

## What WebMCP tools does every page offer?

Every DiceyTable page offers five small tools to any WebMCP agent, with no pairing and nothing to set up. They are anonymous. They
read the same public information any visitor sees, and they never use your account, a table or the editor.

| Tool | What it does |
| --- | --- |
| `site_search_games` | Searches the games catalogue by words or tag, such as `bots` for games with computer opponents. |
| `site_get_game` | Reads one game's public listing by its id or the slug in `/games/<slug>`. |
| `site_search_docs` | Searches these Developer Docs. |
| `site_list_pages` | Lists the main pages of diceytable.com. |
| `site_navigate` | Opens a page on diceytable.com in the current tab. It refuses any other site. |

Game names and descriptions are written by game authors, so these results carry the untrusted-content flag too. To
build, edit or play games, the agent needs the paired tools below.

## How to turn it on

WebMCP rides along with a normal pairing, so you still need the bridge first.

1. Ask your agent to connect, and open **Connect AI agent** in your tab. The steps are in
   [Pair a DiceyTable tab with your agent](https://diceytable.com/docs/ai-agents/setup/pairing).
2. In the consent dialog, tick **Also allow in-browser AI agents (WebMCP)**. It starts off.
3. Type the code and click **Allow**.

Once the tab is paired, DiceyTable starts a second agent session just for the browser's agent, signed in as you and
named *In-browser AI agent*. Then it offers the tab's tools to the browser. The list changes as you move around: the
editor offers editor tools, a table offers table tools. If your browser has no WebMCP of its own, DiceyTable loads a
small stand-in so that extensions which speak WebMCP can still find the tools.

You don't need to switch on any browser flag for the bridge. Whether your browser's own agent needs one is up to that
browser.

## The same rules apply

Every call from the browser's agent goes through the same checks as a call from the bridge:

- the permissions on your key, and never more;
- the same rate limits, and the same **Destructive edits** choice you made;
- the same [actions that need your click](https://diceytable.com/docs/ai-agents/concepts/confirmations), such as publishing;
- the same **Activity…** list, so you can see every call.

Other players see the **AI** badge, and the usual rules about [dice chips and stats](https://diceytable.com/docs/ai-agents/concepts/chips-and-stats)
apply too. Tools that return text from outside you, like card text or chat, carry WebMCP's untrusted-content flag.
That tells the browser's agent to treat the text as data, not orders. See
[Prompt injection protection for AI agents](https://diceytable.com/docs/ai-agents/concepts/prompt-injection).

## What can't an in-browser agent do?

- **Import files.** File bytes reach the tab only through the bridge, so `asset_import` doesn't work here.
- **Ask to publish.** Its session never gets the **Request publishing** permission, even when your key has it.
- **Use the `session_*` tools.** Those live in the bridge, not the page.

Screenshots work, but WebMCP has no picture type. An image comes back as text-encoded data inside the answer, which is
clumsy for most agents. Use the bridge when you want screenshots.

## How do I turn it off?

The browser's agent stops when the tab's pairing ends. Click **Disconnect** on the **Agent connected** chip, or end the
session in [Settings ▸ AI agents](https://diceytable.com/play/settings). To keep the bridge but drop the browser's agent, disconnect, then
pair again with the box unticked. See [Watch, pause or stop your agent](https://diceytable.com/docs/ai-agents/setup/indicator).

## Next steps

- [How the DiceyTable MCP bridge works](https://diceytable.com/docs/ai-agents/concepts/how-it-works): the bridge, the tab and the relay.
- [Is it safe to let an AI agent use my account?](https://diceytable.com/docs/ai-agents/concepts/security-model): the full safety picture.