So What? How to Get Started with WebMCP

Well, hey everyone. Happy Thursday. Welcome to So What, the Marketing Analytics and Insights Live Show. I'm Katie, joined by Chris and John. We got the band back together.

John is under a tornado watch. So if he suddenly blows away, um, thoughts and prayers, John. See the house spinning and uh this week we are talking about how to get started with web MCP. Um I feel like Chris, this is something you've been working on for quite a bit. Um try to get working, you know, in the sense of what you're gonna show today.

And if I recall correctly, I could be wrong, but if I recall correctly, basically a web MCP is a for lack of a better term, a plug-in that you install into your website that allows things to happen in an automated way. Yes. Okay. Well, at least I'm on the at least I'm I'll take that I'm on the right track. I will take the win there.

Exactly. So we should probably start with a bit of history. MCP, which stands for model context protocol, is a way for AI tools like Claude Desktop, uh or Chat GPT or whatever, to interact with systems outside of it. So if you've used Claude's connectors, for example, to talk to your Salesforce or your HubSpot, you're using an MCP. You're using an it's an API for AI, is the way we typically describe it.

MCP servers have been around now for two ish years, I think, and they're they've been met with moderate success, mostly because they're a pain in the butt to set up. But if you get them working, uh it allows your AI tool to talk to all kinds of different systems, do stuff that it was never programmed to do in the first place by letting AI talk to those systems. Promoted most heavily by Google and Microsoft to do the same thing for AI agents. So Katie, you and I talked about this on this week's Trust Insights Podcast, which you can find at TrustIs.ai slash TI podcast. This is a gentic SEO, which is different than GEO or AEO or whatever, and different than AI visibility.

Those are about can we get AI to recommend your company? Agentic SEO is can we get AI agents to work with your website? And if I recall correctly, what we had talked about was so it's the agents are now seeking out information on behalf of the end user. So I could send my Katie AI agent out to the web and say, uh, sign me up for six newsletters that match my interests. But so now the agent has to go out and find, not only find the content, but then also have a place to go to actually do the signing up.

And if that doesn't exist, then the content's great and all, but it's not going to be able to complete the task as I've asked it. So if I'm following the web MCP, I think the way that you described it in the podcast was it's sort of like putting an invisible app store on your website so that when these agents go out, it can say, yes, I want one of these, one of these, and two of these. Let me bring it back to my end user who's asked me to go fetch these things. Exactly right. Or sign up for the newsletter or join the text line or any of those things.

If it goes to the Trust Insights website site, it would say, search for blog posts, uh, or sign up for the Trust Insights newsletter or the podcast, and so on and so forth. So that's the idea is when an agent, and this could be anything. So this could be clawed code, clawed co-work. So Katie, you could take your clawed cowork and say, I want, I want more stuff in my inbox. Go, you know, go find me stuff.

And it goes, it searches the web regularly, which is still GEO. But then once it arrives at the Trust Desights website, it says, Oh, there's a store here. What's in the store? And it says, There's the newsletter sign up. You know what?

My user requested sign her up for newsletters. So I'm going to take advantage of this at this mini app here. Now these are invisible to humans. Humans do not see these. Uh, this is solely by agents.

And that was one of my first questions to you am I adding a whole bunch of stuff to my website that humans aren't going to want to see or is going to be confusing. So when we talk about visibility to these large language models, there is visible content that we create both for the human and for the machine, but we've taught people how to add those disclaimers. Like this is for a large language model to read. And it's sort of that long list of things, those blurbs that we've added to our website. This, what we're talking about, the Web MCP, to your point, is different.

It is not visible to the human. It's almost like uh the metadata in a way, where you can see it behind the scenes, but as you're looking at the user experience of your website, you don't necessarily see it. You have to seek it out from behind, you know, the facade of you know whatever the user is seeing. And we're using store, app store as a placeholder proxy for what we're describing. Um, there could be money exchanged, but we're really talking about things that your agency system can do and essentially take off these invisible shelves and take action on.

And so if those don't exist, then the agent is just doing essentially what if you're using, you know, Claude, the Chrome extension can do, which is basically just gather information and bring it back to you, but it can't do anything with it. And so that brings us to the two components of WebMCP. There's two different APIs. One is called imperative, one's called declarative. Imperative is JavaScript, it is a JavaScript that you put on your website that when an agent arrives, and the script is programmed to recognize an agent by its user agent, it says, Hey, I got stuff for you.

And the agent immediately goes, Oh, thank you for greeting me. Let's see what you got. Declarative changes the HTML on your website to tell an agent for things that you can't put JavaScript on, here's what this is. So, for example, let's say you've got an old school uh contact form on your website, and you maybe you're on a system like Astro, which is pure HTML, no JavaScript at all, you would use the declarative version of WebMCP to say, like, hey, agent, this is a form. The purpose of this form is to contact us.

Here are the fields on this form. Using your browse on behalf, like Claude Cowork does, fill out you can fill out the form this way. So to do a good implementation of WebMCP, you have to have both pieces so that one greets the agent if you your website is a JavaScript enabled site, and one modifies the HTML for websites that don't have a lot of JavaScript. So it's essentially accessibility for agents. Exactly.

And on the declarative side, if you've done a really good job with like WCAG 2.1 implementation, which is web content accessibility guidelines, um, it will be trivial to add the declarative API because you've already done most of the hard work of putting out like making sure every form field has an intelligent name on it, for example. That, you know, that's just good best practice, anyway. That's just good governance. And it's something that we always come back to is if you have good strong governance going into creating your website, developing your content, whatever it is you're doing, you're already ahead of the game. You don't have to recreate those things.

It is always where you want to start is do I have good governance? Do I have good naming conventions? Is it understandable by humans first? Because the likelihood of it also then being understandable by machines is going to be higher. So that way you're not reinventing the wheel.

Uh before we go on, uh, John, our silent partner, uh, thoughts, questions. Like, is this a new concept to you, or is this something that you know you and Chris have been talking about on uh marketing over coffee, for example? Yeah, no, we haven't kicked this around. I mean, because this we've seen this stuff before. I mean, my flashback was to WISDL, you know, like back decades ago, there was protocols that you would set up so that people could use an API so that they could hit it.

So, yeah, I'm I'm used to this kind of stuff, but I'm just really interested in looking under the hood now. So JavaScript to do the initial thing, that's fine. You just grab that template and go. But I don't get the modifying the HTML and how that works. So, yeah, I'm interested in digging in more to that to see exactly what the heck, you know, how that happens.

And then the other is has it been compartmentalized yet? I mean, are there WordPress plugins and stuff for this, or do you just have to do this all manually right now? Great questions. Um, so to start, most CMS systems, including WordPress, have not built this in yet. Uh, in fact, it's it is in some ways so new, I had to have Claude write one uh for the Trusted Sites website, just so I could do this episode of the show and uh the live stream.

Uh, however, it does work. Um, and we'll talk about how to do that in a bit. The spec itself is available, the best version of it is available on Google's website. So Google has this in their Chrome developer system, the web MCP, what it is, uh, how the spec works, things like that. Now, this is something that's gonna be very, very interesting.

Chrome has said that it as a version 146, web mcp is supported. However, 149 is when they rolled it out to non-developers. So if your version of Chrome, and you could just go into the about menu and say, like, what version of Chrome am I on? I'm on 149, you have Web MCP available. Why this is interesting is because Google, and this made a whole lot of people very angry.

Um, Google has embedded a very bite-sized model of Gemini inside Chrome. It's called Gemini Nano. It's a two billion parameter model that does stuff like summarization and things. But guess what else it does? It talks to Web MCP.

So even as you, the human, as you're browsing a website, Chrome might call its own internal model and say, hey, it looks like this is the Trust Insights website. It looks like they got a newsletter. Want me to sign you up for it? And it will edit a little sidebar and it will fire off and it can fire off and do that. So this is live as of Chrome 149, which is the current version.

You can see on Google's chart here, in version 157 of Chrome, that's when everybody's gonna get it and it's gonna be stock, it's no longer being gonna be in beta, um, and it will be it will be the thing that will be built into Chrome. And so for all of us who are marketers, if we want Chrome, which is the number one browser right now, uh, to recognize our web MCPs, now is the time to implement it so that we have time to test it before it's turned on for everybody by default. I guess I'm a little confused though, because you just said that to date, no CMS system has Web MCP available. Right. So you had to build one.

But Chrome is saying, yeah, go ahead, we can read it, but it's like read what? Right. So I'm I'm I'm genuinely okay. So I just want to make sure I was fully understanding that there's a disconnect between what Chrome is saying it can access and there being anything accessible to Chrome. Exactly.

So Argentrial, the way I would explain this is origin trial means everyone has access to it, but you have to turn it on. Shipping means everyone has access to it, and if you don't want it, you have to turn it off. So Chrome can, if you browse a website that has Web MCP, once 157 is out, Chrome will by default start to find it and tell you that it's there. Today it doesn't do that. And to your point, Katie, because almost no one has implemented it, there's nothing to show.

Okay. That's so I like I because I understand, you know, the phases of the roadmap. It was more, what is it even looking at if it doesn't exist? Exactly. Very few sites have implemented it.

Okay. Which means, uh, you know, what was the uh what was it from uh margin call? You can either be you can either cheat, be the smartest, or be first. It's easiest to just be first. Um so if you in your industry have the ability to turn this on in some meaningful way to expose some meaningful functionality, A, you'll be able to test it what uh long before your competitors do, assuming that they're not testing it, to see what things should we even make available.

And B Google has said that all of the agentic stuff doesn't impact search rankings, which I believe because they're separate. But it doesn't mean that Google won't give it preference if it f if it says, like, hey, if you're an agent and you're doing a Google search as an agent, here are sites that have WebMCP available that you might find more useful because we can already see that in AI mode, it is an agent, right? It it can go in read site. So if Web MCP is there, AI mode might, this is pure speculation, might say, hey, Web MCP is available and it's our standard. You might get more benefit out of the site than the site that doesn't have it.

Okay. Um so I'm guessing the next step is you are going to show us what an MCP looks like. Sure, how to set one up because like right now, and I feel like so. I was just looking, we have a ticker that says, you know, we are not lawyers. I feel like we need a ticker that says this is pure speculation, this is the way we think things are going to go, but don't, you know, don't come back to us if it doesn't work out this way.

Um, so the first thing you'd want to do is you would want to install the Web MCP inspector, which is a free Chrome extension made by Google that you install on your browser right now so that it's like a debugger, but a debugger for Web MCP so that you can see when you're trying to install it, is it even working? Is it there? Because remember, right now in Chrome, there's nothing to see, right? Because it's it's available, it's detected, but there has been functionality built into the browser using Gemini Nano to say, hey, here's what you can do. So I have mine, I have mine installed.

Uh let me go to the Trust Insights website. The moment I load the Trust Insights website, I see in the inspector, hey, Web MCP is on, and here are all the things that you can do as a user on this website. You can do things like search published posts and pages, public stuff. You can fetch a single published post, you can list items, you can return basic public information, you can let the most recent published posts, you can fetch a single author's posts, you can send a contact form message to contact Trust Insights. Um, you can register an email address and subscribe to our newsletter.

So all these functions, the moment an agent shows up, it's given the menu and said, Hey, here's all the stuff you can do. Couple questions. Um, I guess the first question, and maybe this is more of the concerned citizen question, is now that agents can access contact forms and fill them out. Should we brace ourselves for an exponential number of spam contacts? Uh-huh.

And that's really gonna mess with our overall analytics. Is it going to also mess with our analytics in terms of like sessions and users coming to the site? If because we can't distinguish if it's human or agentic, you sometimes can based on the browser agent, depending on how the agent is showing up. So if it's using an internal system like a headless Chrome, it will probably have a different user agent than an actual Chrome browser. But this is something that you would need to look in your server logs for.

And if you have your own agents, test it out to see, like, for example, one of the things you can do is you could put up a test script in PHP or or TypeScript that is on the back corner of your website somewhere that says, when you browse this page, just print the user agent. And then you say, hey, Claude, go visit this page and tell me what user agent shows up. Or you use Chrome, and it says this is the user agent, just so that you can see what the different user agents are. So it sounds like maybe a future episode of the live stream is how to set up your web analytics to account for all of this new agency traffic and those kinds of things. So we can just sort of bank that in this idea.

My other question is, and I think this is sort of what you're getting to is so you turned on Chrome's Web MCP, and then you went to the Trust Insights website, and it's like, hey, you have an MCP to look at. Which we started by saying most CMS systems don't have an MCP. And so this sort of brings us sort of full circle of you've been building this to install into our website specifically, and that's why it's registering that there is a web MC MCP. They need like less complicated names. Web MCP to look at.

And that's I'm following all of this correctly. That's correct. I had to build a WordPress plugin, net new, to do this. And boy, did that take a few tries. And uh as a as a point of reference, you can do the same thing if you have access to a tool like OpenAI Codex, Google Anti-Gravity, Claude Code.

Uh, the spec is fully available for free on Google's website under the Chrome Developers. Download the entire spec, put it in your coding tool and say along with your best practices, your coding standards, and all the uh other stuff, and have it build a plugin for your CMS. Uh, and and here's the reason why it's not going to be as easy as just an out of the box thing, because every website is different. So, for example, the Trust Insights website uses Gravity Forms for its contact forms. Gravity Forms is not a native part of WordPress.

So our Web MCP plugin takes in uh the Gravity Forms endpoints and makes them available as WebMCP. If you were to install this on marketing over Coffee that doesn't have Gravity Forms installed on it, has uh WordPress Contact Form 7, you would need to change the plugin itself to work with that architecture. If you were using Sitecore or Ectron or uh you know the CMS of your choice, Adobe Experience Manager, they would all need to build their own Web MCP interfaces. Do you, and this is again where we need the ticker of you know, this is just speculation. Do you anticipate that?

I don't even know what it would be, I guess. The same way we look at connectors in something like a Cloud Desktop or there was those N8N systems that had all the different connectors. Do you think as Wem C Web MCP becomes more commonplace, systems like that will have those different CMS connectors like an Ectron, like a Sitecore, like uh you know, all the different ones you listed, versus having to build your own? Yes. What I think will eventually happen is that you'll have a master web MC plug MCP plugin and then have plugins for your plug-in for the different systems.

Like so, if you have Gravity Forms, there's a Gravity Forms connector to your web MCP plugin and so on and so forth. So there will be a bit of a land grab uh in in the CMS world to as to who can build the plugins the fastest to grab the market share for them. Which goes back to you good need to have good governance around what it is you're already using. Uh one of the things that we do with our clients is we audit their tech stack, and a lot of times they're surprised at things that exist in their tech stack. And so if you haven't done this recently, like, and I mean within you know the past six to twelve months, and to take it a look at all of the different tools you're using.

Now is a good time, even just to get a basic inventory of all of the different systems you have. So as these kinds of things roll out, and it sounds like it's going to be very term, nested, like a plug-in for a plugin for a plug-in. Like you want to make sure you have a good understanding of what's going where and not just turn on access to everything because that could be very volatile or dangerous. Yeah. Very bad.

Don't do that. Um, to show you what the plugin looks like, this is pretty rudimentary right now because I literally cobbled together for like three weeks uh and on Tuesday nights. Uh a, you can turn on and off website web MCP. Uh you have the rate limiting, and then you can choose which tools you want. So, for example, I don't want people to submit comments.

I agents take a hike. I don't want you writing comments on our blog. Um, agreed. But but I can say subscribe to the newsletter, etc. etc.

And so there's all these different things. This is again, this is custom to the trust Insights WordPress. So it's it's I can't even put this on my own website because I would have to retune it for that particular site. Again, that will change as the standard evolves as and things like that. But for right now, we at least have this in place and it's working.

The one thing I'm going to add to it, uh, which is I have on my own personal roadmap is for this is integration with Google Analytics measurement protocol so that when Web MCP is called, it sends a hit to Google Analytics to say, hey, I just got an agent visit. I want to log it as something different than a regular web visit. Well, and that goes back to my comment that a future live stream would be, you know, how to maybe basically reconcile your web analytics with these agentic MCP systems, because it is, I'm already looking at this, I'm like, well, it could we probably want to make some sort of a notation, an annotation in our data on the day that we turned on this ability, because we could see theoretically, hopefully, you know, podcast subscribers grow, newsletter subscribers grow, and we don't want to be sitting there wondering, oh, what did we do? What happened? These are the kinds of things that you need to have those internal notes and have those notes available and accessible when you're doing your analysis to make sure you know, like this is a big change in how traffic gets to your website and how conversions on your website happen.

You want to be able to make sure that you can explain that. Like it's great if things go up, but then people are gonna say, Well, what happened? What did you do? Do more of it. Exactly.

Uh, and one of the things that is worth pointing out, which uh a lot of people are very, very uncomfortable with uh right now, is when you look at what's happening on the internet. 58% of the internet usage on the planet now is machines. It's no longer humans, right? So humans are now in the minority. And so as you start to see mixed purpose agents or user action agents starting to visit more and more and more, you're gonna want to know who what kinds of agents are coming to your site and what it is that they're doing.

So Cloudflare's already said you probably should have this in place sooner rather than later. But again, this is it's you can have it in place sooner rather than later if you know how to build it. In the meantime, waiting for these CMS systems to build their own, that you can, if you look at like all the settings on the left-hand side, you can just flip it on or off. And so it's I just find I find it interesting, sort of like the push pull, like the supply and demand. It's like we're demanding that you have it, but there's no supply to meet the demand, like it's it's basic business.

So I don't, I mean, you there's not for us to answer on this because we don't we don't know why things take as long as they do, or you know, if you should ever use v1 of something, the answer is no. Um, it's just it's interesting to me that Google is like, okay, so like everybody can access it. And it's like access what? Yep. What am I doing?

I know I know that you know AI is taking over web usage because everyone's turning to Chat GPT saying, give me a, you know, uh fish fillet recipe. And so that's your stand-in for web browsers now. I I totally understand that, but like we don't have the things we need to meet what they're telling us to do. Right. Well, the the vast majority of people do not.

Uh and that's why I said there's there is a potential early mover advantage here. This would be especially important if your site is any kind of e-commerce site where someone could make a transaction on your you know, so if an agent that has been authorized by you to make purchases on your behalf, having that there would be useful for that agent. So there are people, for example, uh, who have set up OpenClaw and Hermes agent and given it a budget and said you can't spend more than this amount on a single transaction. But let's say you had a uh a custom socks website uh and you had a special, a $13 pair of socks for you know robot socks. Um if an agent dropped by there and said, Hey, this looks like the kind of thing my user was like would like.

My user said, I can't spend more than $50 on any one transaction. I can't spend more than $100 a day. I'll bet you they'd like this pair of socks. Buy and the agent get orders you a $13 pair of robot socks. Now, whether you like them or not, that's your problem.

But an e-commerce site at the very least should have something like this to tell an agent here's what is for sale, and ideally surface things like search functionality on the site in an easy way for the agent to uh traverse the site and return results back to the back to the hive, if you will, um, of what it found. You're paying way too much for socks for something that doesn't have feet um other use cases would be agent to agent support so the ability for your agent to talk to another support agent and the two of them negotiate something and then like to to basically say hey I will have I will call you when I've actually gotten past their agent to talk to a human you know it I can see how that's a powerful use case because none of us I was trying to do this yesterday in reaching my insurance company for my car and I couldn't get past the agents they just kept giving me the same two responses and I was like I'm not asking for either of those things and I couldn't get to human so like I can definitely see that but at the same time it's very sci-fi and you know I think that you know there's a lot of I just want to acknowledge that like with this there's a lot of fear probably around like what is it actually going to do what is it doing on my behalf like you know should I give it that much control like I'm giving it a $50 budget but you know was I very clear about what I want am I going to get a bunch of inappropriate or unuseful things sent to my house I don't know um I'm just gonna make a quick you know I have to do it get yourself set up started with the five Ps the five P framework by Trust Insights you can learn more at trust insights ai slash five p hyphen framework purpose why am I doing this thing in the first place? People who's involved, the human, and then also the agentic process. How is the thing expected to get done? Have I been clear with my standard operating procedures, with the details, with the directions, with the instructions?

Platform, this is where your governance comes in. Only give agentic AI access to what it needs, not to everything. And then performance. Can it complete the task? Did I do what I set out to do?

Did I answer the question? I cannot emphasize this enough that you really want to make sure you're clear about why you're turning on a web MCP before you turn it on. Yeah, exactly. So in terms of next steps, here's what I would do if I was the average site owner. Number one, I would make the site WCAG 2.1 accessible first.

That's low-hanging fruit. There's proven tools, and there's a known benefit, which is five to 10% of people browsing the web are using some kind of low vision assisted tool. So by making your site fully WCAG compliant, you also make it easier for those people to do business with you. So that's that's number one. If you can do that, do that first.

Second, go ahead. Nope. Go ahead. Second, implement the declarative API for um WebMCP, which is where you take the all the work that you did to make it accessible and just make sure it also conforms with the Web MCP declarative API so that a browser agent, a web agent or an AI agent, can browse your site successfully and easily and know, you know, like your form fields are not named form field 26, form field 27, the name, first name, last name, et cetera. That's the that to me is the first two steps.

And then the third step is with the help of your coding tools and the spec that Google has published, which is available on their website, it's available on GitHub, build something that addresses the imperative API, which is the heavier lift. It's the app store. That's the order I do things in because the more the further along you go, the more kind of far out it gets. Like WCAG compliance is a no-brainer. Is it fair to say that you can drop a link to that resource in our free Slack community analytics for marketers post live stream?

I sure can. So if you want to link to uh the compliance that Chris just mentioned, what is it? Uh WCAG 2.1. WCAG 2.1? Yes, web content accessibility guidelines.

Got it. If you want to link to that and what that means, you can join our free Slack community, Analytics Marketers at TrustInsights.ai slash analytics marketers. I've heard you mention that on numerous calls. Um, but having a resource to actually go to to say, oh, what is this thing? What does this mean for me?

Uh, is probably really helpful for a lot of people because it may be a brand new concept. Yeah, it shouldn't be, but unfortunately it is for a lot of folks. Dude, the thing I get wrapped up around though is also having a model baked into the browser now. So basically, you've got a model in the browser and you've got sites there encouraging them to make a map that the model can hit. So it's you're literally you could.

I don't know. Is there any talk about how often that phone's home or if that can be remotely fired? So it's actually the opposite. So Google, if you go into your system settings inside Chrome, there's a little toggle button here to turn this on. Um, and Gemini Nano will uh activate it.

Doesn't necessarily call home any more than the normal Gemini telemetry Google telemetry because Chrome calls home all the time about everything. Um but the this is actually intended to help Google offload some of the the load on their servers by making your computer do some of the work. So in their in a lot of what they say about browser stuff, this particular model for on device AI will help you do stuff like summarize web pages, organize stuff because it's a small LLM. And so it's it's designed like hey, summarize this page. It will do that and it won't have to call to Google's cloud to do it and cost them money.

Right, yeah, but it's so they are they're farming that processing back to the desktop, right? That's interesting to me that they can uh and and so I don't know. So that's off by default now, but is it so? Is that as part of once they reach version 56 or whatever it is, that will probably be on by default, I would imagine at some point. It's on by default now.

They they pushed it out, and it was a big outcry. They like people like, hey, what is this two gigabyte file that just appeared on my website on my browser? Oh, that's the new Gemini Nano model. Yeah. I got to hear all last week from my mother-in-law who was visiting about how every time she opens her pick a Google thing, there's AI trying to do something for her.

And I said, you know, you can turn that off, right? Um, so I think that there's a lot of to Chris's point, there's a lot of outrage of what do you mean this is turned on by default? And yeah, you can just turn it off, but they don't make it intuitive to be like, hey, do you want to turn this off? Yes, no. You go have you have to go find it in the settings and know what it is you're turning off.

And then if I remember correctly, they give you a little warning like, hey, if you turn this off, you don't get all the cool prizes. Yep, exactly. Um, they actually have lots of documentation about what that system is going to do uh in terms of on device AI. Uh and the things that it's going to be able to do uh out of the box once it's fully live is summarize stuff, you can have it write stuff, rewrite stuff, proofread stuff, fill in stuff, uh, and importantly, do stuff. And this is where Web MCP is going to and the on-device model play together.

Is once it has the task API fully implemented, if I'm on a website like a Trust Insights website and the on-device model is on and watching everything I do, uh, it will say, hey, you're here. Do you want to subscribe to this newsletter? And instead of you saying, 'Yeah, I want to subscribe to co-click form, click, type my email just,' it'll say, 'Great, I'll take care of that for you.' You can continue on with whatever you're doing. And so for us as marketers, we want to have that in place. We want to say to people's agents or even their browsers themselves, yes, come on in, sign your user up for our stuff.

Um the user may not be cool, but this is why we're having the discussion about WebMCP today, because these APIs that are built into Chrome using its on-board AI are going to start when it's available to Katie's point. When it's available, it will start suggesting things. And so if you have trust insights and you have, I don't know, ACME Consulting Corporation and the users visiting both sites. If they visit ours and Web MCP is working, and uh Chrome says, sure, I'll I'll sign you up for you know, you're trying to learn more about this stuff. Maybe you came from an AI mode search.

It will say, Okay, I'll get you subscribed to the Trusted Test Newsletter. Then you go to Acmin Consult, nothing happens. And so we might have a slightly better chance of converting that lead because we've gotten them sooner. Interesting. Well, there's a long historical track record of you know rolling out stuff Google suggests, usually helps you out, you know, in the long run.

So one of the things we said we were gonna do on this episode was how to get started. Now, obviously, we're not gonna sit and watch you for three weeks, you know, develop uh against our WordPress site. Uh, is it a good idea or a bad idea to open something like Claude Code and just say, hey, Claude Code, I want to build a web MCP for my website, which is hosted on WordPress. Can you vibe code that for me? Um yes, with an asterisk.

Let me show you. I'll walk you through the process that I went through. Um, I went to Google itself, and then three other um AI systems that have deep research. And I said, do the research on Web MCP on what successful implementations look like, what the standard says on the most common use cases. And uh Alibaba Quinn, Perplexity, Gemini, and Claude were the four systems that I had put these reports together.

From those four systems, I then said, okay, got it. Turn this into a product requirements document to build a WordPress plugin for my site. I say we are on WP Engine, we use Nginx, we are on this version of WordPress, which has this version of PHP. Based on, oh, and oh, by the way, I also have a separate file of best practices for building WordPress plugins that I built the exact same research process. Claude code said, got it.

I'll read this plugin guide. I'll read this web MCP guide, and I'll come up with a PRD, which contains user stories, technical requirements, functional requirements, non-functional requirements, domain requirements, milestones, KPIs, and the 5P framework by Trust Insights. PRD is done. Then the next step is okay, Claude, you've built the PRD. Now build the technical spec.

So this if the PRD is sort of the why you do something, the spec is what are you going to do? What are the pieces? So it then draws from the sources again, builds a full technical spec of the 11 pieces that this plugin is going to need to have. It writes that out. Then with the the PRD and the spec in hand, I say to Claude, now build me a work plan with up to 10 phases of how you're going to build this sucker.

And it walks through and says, okay, here's all what I'm going to do. I'm going to do these are my non-negotiable engineering standards. These are what we I must do or what I must not do. And it runs through and builds the entire work plan. Then and only then we say to Claude, okay, build it.

And then for you know several hours, it's just going to go off and do the thing. But I had to do all the research first, do all the planning first, do the spec first, and then and only then can I vibe code? So you answered the question and correctly. So the answer was no. It was not a trick question.

There was only one correct answer. The answer is no. But what you illustrated is what I was looking for is no, don't just open up Claude Code and say, I want to build a web MCP against my W, you know, my WordPress website, go. You need to still do the planning. And so, Chris, what you mentioned is again the 5P framework by Trust Insights, which you can get at TrustInsights.ai slash 5p hyphen framework, because we're still talking about resource usage.

We're talking about token usage, we're talking about spending money, we're talking about spending time. We're talking about introducing data privacy holes in your existing website. We're talking about misrepresentation of you know whatever within the code to say, like, hey, you can totally do that. Like, yeah, I'm totally fine if you spam 8,000 different websites and put my name and home address uh and phone number in the contact form. Like, yeah, sure, go ahead.

Like, you want to make sure that you're not introducing those vulnerabilities. And so, no, don't just open up your coding system and say, hey, go do this thing, do the research, build your plan. So a PRD is uh product requirements document, a technical spec is technical specifications, million and one templates on the internet if you've never built one before. Like just look those things up first and say, what do I need to do to build requirements so that this does not go off the rails? If you've never done software development before, there's you know, plenty of resources for software development best practice, find some that you like and then adapt it to what makes sense for you and your business.

Do all of that first. And then you can do proper coding. It is no longer vibe coding because you have a plan. Not only that, you just said something really, really important. And this is the this is the watchword that I want everyone to pay attention to.

When you hear the word web, the first thing on every checklist should be security. These, this is in my this is my own guide of the best practices. These are the things that go wrong the most when you're making a WordPress plugin. If you try to vibe code it, most of the tools will not think about security because it is not part of their mindset. So if you do not have checklists of this is what to avoid doing, you're going to vibe coding something dangerous.

You're going to vibecode something that makes Swiss cheese out of your website's security, and someone can exfiltrate data from it. You have got to have this. So if you do not have a dedicated security section in your PRD, in your spec, in your work plan, in your checklists to validate for the when the agent is done. Stop immediately and make sure that you build them. So how about as far as output then, once that plugin is run, is that dynamically generating the JavaScript file just every time it runs or you know, anytime there's a major site change?

So the way that I built the plugin is that it dynamically generates the imperative API for stuff that's site wide, like hey, subscribe to our newsletter and things, but then also it gives options uh if it's relevant on specific pages. And then for the HTML, there's no need for it to actually touch the posts and dig into the HTML. It will modify the HTML if you have things that are non-compliant. Like if you don't have ARIA labels on stuff, it will add them. Okay.

So yeah, this is like it's it's touching all the parts and pieces. You can't this can be very dangerous if you don't uh have it set up the right way. Yes, which means you like you said, you have to do the 5P framework and part of performance is security. So the the access that we the four part we always say is it has to be safe, it has to be efficient, it has to be effective in terms of what it does, and it has to be fast. Those are the fourth dimensions that all code you have to figure out.

And when you're talking to a coding agent like Claw Code, you say these are your four objectives, you must meet all four. You have to figure out how to do this. But you should, as the human have some semblance of what that looks like ahead of time, because if you say, here are the four things you need to do, and Claude Code says, Okie dokie, I'm gonna go do them, and you don't know what's right and what's not useful. Um, you could be saying yes to who knows what. You know, so make sure you, the human, this is where human in the loop is so important, especially with these kinds of things, is you want to make sure you understand, even at a high level.

So I couldn't list off all of the different ways that somebody could hack a website, but I know enough to take a look at, you know, a security list and protocols and be like, yep, okay, that makes sense. Let me just research this a little bit deeper so I have good understanding. But like I, as the human can do that. I don't need to be an expert, but I need to have at least, you know, sort of like we say about sports. Like you should have at least a decent enough understanding of what happened in the game to have a casual conversation.

You should probably at least know what two teams are playing. And that should get you far enough in the conversation. And if you aren't sure, go to the Trust Insights website. We have the casino framework, which has nothing to do with gambling, uh, but is a prompt research framework for deep research tools. Fill it out, fill out the template, and then hand it to your favorite tool.

And your context might be I need to know how to secure a web or WordPress plugin, hand the framework, maybe even to your AI tool and say, help me fill this out to build a research brief and then let a tool like cowork or code or whatever you go and do the research. Um, that's how I do stuff for things that I don't have strong domain knowledge myself. I will say, let's build this research brief. Ask me questions until you have enough information to fulfill the brief. It builds the brief, which is like this long, and then I go and hand that to all the different agents that pull in all the information and then cross-check them and say, okay, well, what do they all have in common?

Uh, you know, what are the what are the things that everybody agrees on? Like, yeah, you should always be escaping this type of HTML. Like everybody says that. Okay, okay, that has to be in the main rules. But that's how I that's how I built this thing.

Because I know that I don't know everything about uh WordPress security, but I know that AI can find it. Mm-hmm. All right. Well, set your uh web MCP agents loosed on the Trub Web Trust Insights website. I guess that's the next logical step.

That would be the uh yeah, that me that would be the logical step would be deploy it and then test it, please. Yeah, don't skip the testing. Yes. Uh, but I would recommend that if you are you know to what John was saying earlier. Rarely do you go wrong if you do what Google says.

Just the way the world works. Any final thoughts? Yeah, I'm gonna get uh concert and sports tickets via AI agents. This is my new thing. Look for John's Ticketmaster coming soon.

Well, I mean, it's an interesting use case because for a lot of these things, like you have to sit and sit in the queue and keep refreshing or whatever it is. Like, yeah, that's a great use case to let an agent be like, hey, here's where I want to sit, here's my budget, go get me tickets. I don't want to sit in that queue. Plaud court can do that for yeah. Mm-hmm.

Yeah, no, it's interesting to think about. Like, as the technology advances, I think my takeaway is that it's even more imperative to have a good handle on your security and governance before these things get too out of hand. Yep. And then go do it. Go do it, be be early.

Very rarely do you like incur serious harm from be from being early as long as you do the planning of governance up front. Yeah, I was gonna say, with that caveat. Exactly. All right, folks, let's go do it for this week's show. Thanks for tuning in.

We will talk to you all on the next one. Thanks for watching today. Be sure to subscribe to our show wherever you're watching it. For more resources and to learn more. Check out the Trust Insights podcast at TrustInsights.ai slash T I podcast.

At a weekly email newsletter at TrustInsights.ai slash newsletter. Got questions about what you saw in today's episode? Join our free Analytics for Marketers Slack group at TrustInsights.ai slash analytics for marketers. See you next time.