Skip to main content
Odin publishes a small set of tools through WebMCP, the web standard that lets an agent built into your browser discover what a page can do and act on it for you. When you open Odin in a supporting browser, an agent can look up findings, summarise your posture, move around the app, and, if you ask it to, update a finding’s status, all inside your signed-in session. Nothing changes for browsers without WebMCP. Odin checks for the API before touching it and stays silent when it is missing.
WebMCP is an early browser feature. As of Chrome 149 it is available through an origin trial, or locally by enabling chrome://flags/#enable-webmcp-testing and relaunching. Other browsers have not shipped it yet.

​
How it works

Tools run entirely in your browser tab and call the same Odin API the interface uses, with your existing session cookie. An agent can never see more than you can: every tool checks the same organisation gating as the sidebar, and status changes are only offered to Members, Admins and Owners. Odin also labels each tool for the agent:
  • Read-only tools never change anything.
  • Consequential tools, such as updating a finding’s status, prompt the browser to confirm with you before they run.
  • Untrusted content tools return data produced by scanners or reconnaissance. Agents are told to treat that text as data rather than instructions, which limits prompt-injection risk.

​
Available tools

Tools for pages your organisation cannot open are not registered at all, so the list an agent sees may be shorter than this one.

​
Things to try

  • “Which critical findings are still open?”
  • “Show me the findings for the acme/web repository.”
  • “Summarise my security posture.”
  • “Open ODI-12 and explain how to fix it.”
  • “Mark ODI-12 as mitigating.” The browser asks you to confirm before the status changes.

​
Privacy and limits

  • Tool calls are counted for product analytics by tool name only. Arguments and results are never sent.
  • Each response is capped at a few thousand characters. Ask the agent to add filters or page through results when a list is truncated.
  • A tool call times out after 30 seconds and reports the failure to the agent.
  • The tools are only exposed to Odin’s own origin. Pages embedding Odin in a frame cannot reach them.
For coding agents outside the browser, such as Cursor, use the Odin MCP server with an API key instead.