WebMCP in Laravel: Add AI-Agent Tools to Your PHP App

A Laravel app already has what WebMCP tools need: routes, validation, policies and a session. You only add a small script to the page. New to the topic? Start with what WebMCP is.

Step 1: A small JSON route

Use a route in routes/web.php, so the visitor’s session applies, and add a rate limit:

Route::get('/agent/products', function (Illuminate\Http\Request $request) {
    $data = $request->validate(['q' => 'required|string|max:80']);

    return App\Models\Product::query()
        ->where('published', true)
        ->where('name', 'like', '%'.$data['q'].'%')
        ->limit(5)
        ->get(['name', 'price', 'slug']);
})->middleware('throttle:30,1');

Select only the columns a customer may see. Never return a whole model.

Step 2: Register the tool in Blade

Add a script to your layout, or push it only to the pages that need it:

@push('scripts')
<script>
  const mc = document.modelContext || navigator.modelContext;
  if (mc && mc.registerTool) {
    mc.registerTool({
      name: 'search_products',
      description: 'Search published products. Returns name, price and slug.',
      inputSchema: {
        type: 'object',
        properties: { q: { type: 'string', description: 'Keywords' } },
        required: ['q'],
      },
      annotations: { readOnlyHint: true },
      execute: async ({ q }) => {
        const res = await fetch('/agent/products?q=' + encodeURIComponent(q));
        return await res.text();
      },
    });
  }
</script>
@endpush

Step 3: Blade forms as tools

Add toolname and tooldescription to a form you already have. Labelled inputs become the tool’s inputs. Keep @csrf in place. The browser fills in the form and, by default, the visitor presses the button.

Step 4: Sensitive actions

For a POST tool, send the CSRF token in the X-CSRF-TOKEN header, and authorize the action with a policy as usual. Mark the tool with consequentialHint: true.

Safety rules

• Start read-only. Search and details first; mark them with readOnlyHint.
• Ask before acting. Mark cart, booking and form actions with consequentialHint, so the visitor confirms.
• Check on the server. The browser is not a security boundary, so validate every input and permission in your backend.
• Return little. Send only what a customer may see, never admin data or other customers’ records.

Test it

1. Use a recent Chrome with WebMCP turned on, through the origin trial or the testing flag.
2. Call each tool with good and bad inputs.
3. Check that normal visitors see no change.
4. Run the free WebMCP checker on the exact page where your tools live.

Want it done for you?

We add WebMCP to Laravel and PHP apps. See our WebMCP integration services, or check your current PHP version with our free PHP version checker.