Content security policy#
A content security policy (CSP) is a header some sites send to say which addresses a page may load from. If your site has one, add:
| Directive | Add |
|---|---|
script-src |
https://js.subcontext.com (or put a nonce on the script tag) |
connect-src |
https://subcontext.com |
The script loads no styles, fonts or frames and opens no WebSocket connections.
Troubleshooting#
Start with the browser's developer console (filter on Subcontext.webmcp) and its network tab (look for
requests to https://subcontext.com/api/v1/webmcp/config). Example 04 runs most of
these checks.
| What you see | What it means and what to do |
|---|---|
No Subcontext.webmcp v0.1.0 line at all |
The script didn't load. Check the address in the tag, your CSP script-src, and the network tab. |
this browser doesn't support WebMCP |
This browser has no WebMCP, or it is switched off. See What is WebMCP?. Also check window.isSecureContext is true. |
v0.1.0 and then nothing |
The script found no data-key. Check the attribute is on the WebMCP script tag itself. Add data-debug="true" and show the Verbose console level to see more. |
failed to register WebMCP tools a key is required |
init was called without a key (or with an empty one). |
failed to register WebMCP tools Error: Unknown WebMCP key. |
Error code invalid_key. The key is wrong, or it was rotated. Copy it again from the integration's page. |
... Error: This WebMCP key has been disabled. |
Error code key_disabled. Tick Enabled on the integration. |
... Error: WebMCP isn't enabled for this account. |
Error code not_entitled. Your plan doesn't include agent access, or your account isn't paid up. Ask Subcontext. |
... Error: This page isn't allowed to use these tools. |
Error code origin_not_allowed. Add the page's website to the integration. Type location.origin in the console to see exactly what to add. A www. prefix, or http instead of https, makes a different website. |
... TypeError: Failed to fetch |
The request was blocked. Usually your CSP connect-src doesn't include https://subcontext.com, or there is a network problem. |
... Error: config request got a response that isn't JSON (HTTP 500): check the base URL |
Something other than Subcontext answered, or there was an unexpected server error. If you set data-base-url or baseUrl, remove it. A tool call with the same problem says tool request got a response that isn't JSON (HTTP ...). |
... Error: config request failed (N), where N is an HTTP status |
Subcontext answered with an error but no message. Try again in a moment. If it keeps happening, ask Subcontext. A tool call says tool request failed (N). |
registered 0 tool(s) |
No tools are ticked on the integration. |
failed to register WebMCP tools with a browser error about a duplicate |
Another script on the page registered a tool with the same name. None of the Subcontext tools are left registered. |
Errors from tool calls#
When a tool call fails, execute fails with the message in the last column. The AI assistant sees the same
message, so it can explain or try again.
| HTTP status | Error code | Message |
|---|---|---|
| 404 | unknown_tool |
Unknown tool. |
| 403 | tool_disabled |
This tool isn't enabled for this site. |
| 422 | invalid_input |
The tool's own message, for example: A product `slug` is required., Provide at least two product `slugs` to compare., Provide an email address or a phone number., `start` must be an ISO 8601 date-time (e.g. 2026-09-12T14:00:00)., That time is in the past: offer a future time., The team is closed that day: offer another date., That time is outside business hours (09:00–17:00): offer a time inside them., That time is no longer free: offer another., Unknown product type "x". |
| 404 | not_found |
For example: No product with slug "x"., This firm has no agent available to answer questions., No matching contact: call register_interest first., This firm hasn't set up where to talk to a specialist yet., The calendar is unavailable right now: try again shortly. |
The key, plan and website errors from the table above can also come back from a tool call, for example if you rotate the key while a visitor has the page open.