WebMCP’s Cross-Origin Tools Need Three Opt-Ins. Cloudflare’s Backends Differ

The November 2 draft separates embedder delegation, caller discovery and provider exposure for cross-origin in-page tools. Cloudflare’s Browser Run docs show why those rules must be checked against the actual backend.