AI agents can reduce the time required to discover products, compare eligible sellers, prepare procurement paperwork, and monitor order workflows on India’s Government e-Marketplace (GeM). However, an agent should not be treated like a browser macro that clicks through a government portal without supervision. GeM involves public procurement rules, buyer and seller eligibility, catalogue conditions, bid processes, taxes, delivery terms, approvals, and auditability.
WebMCP can provide a safer architecture for this problem. Instead of asking an AI model to interpret every page and execute arbitrary clicks, WebMCP-style tools expose structured, bounded capabilities that an agent can call with explicit inputs and permissions. The result is a more reliable system for assisting authorised users while keeping final decisions, financial commitments, and compliance-sensitive actions under human control.
What WebMCP means for GeM automation
WebMCP refers to exposing website capabilities to AI agents through structured tools and machine-readable actions. The exact implementation depends on the browser, framework, and MCP-compatible runtime, but the core idea is consistent: the website or an integration layer publishes functions an agent can discover and invoke.
For a GeM assistant, tools might include:
search_catalogue— find listings using keywords, category, specifications, price range, and delivery location.get_product_details— retrieve seller, brand, model, warranty, tax, delivery, and specification information.compare_listings— normalise comparable offers without silently changing procurement criteria.check_buyer_constraints— validate organisation, role, budget, location, and purchase route.prepare_comparison_note— generate a reviewable document with source links and timestamps.get_bid_information— read bid status, deadlines, terms, and participation requirements.draft_cart_or_request— prepare, but not submit, a procurement action.track_order— retrieve status and expected delivery information after an authorised purchase.
The important distinction is between *read*, *prepare*, and *commit* operations. Search and extraction are usually lower risk. Adding an item to a draft cart may require more controls. Placing an order, submitting a bid, accepting terms, or making a payment should normally require explicit human approval and fresh confirmation.
Why AI agents need guardrails on the GeM portal
GeM is not simply an online retail marketplace. It operates within India’s public procurement environment, where the procurement method and documentation can be as important as the selected product. Depending on the transaction, users may need to follow applicable General Financial Rules, Department of Expenditure guidance, ministry or department procedures, delegated financial powers, and GeM-specific rules and terms.
An AI agent can also make errors that are difficult to detect:
- Treating similar products as equivalent despite different technical specifications.
- Comparing tax-inclusive and tax-exclusive prices incorrectly.
- Ignoring delivery location, installation, warranty, or service-level conditions.
- Selecting a seller based on ranking rather than objective procurement criteria.
- Confusing a catalogue purchase with a bid or reverse-auction workflow.
- Using stale availability, pricing, or bid-deadline information.
- Revealing credentials, internal budgets, or sensitive buyer information to an external model.
- Taking an irreversible action without the required approval or financial authority.
WebMCP should therefore be designed as a policy-controlled tool layer, not as unrestricted browser access. The agent should be able to do only what its user, role, and workflow permit.
Reference architecture for a WebMCP GeM agent
A production system should separate the language model from authentication, policy enforcement, tool execution, and records. A practical architecture contains the following layers.
1. User and identity layer
Authenticate the human operator using the organisation’s approved identity provider and enforce role-based access control. The system should know whether the user is a buyer, requisitioner, technical evaluator, finance reviewer, approving authority, or administrator.
Never place GeM passwords, one-time passwords, signing keys, or payment credentials in the model prompt. Use secure session handling, short-lived tokens, secrets management, and an approval service outside the model context.
2. Agent orchestration layer
The orchestration service interprets the user’s request, selects tools, maintains task state, and asks clarifying questions. It should preserve the original procurement intent, including quantity, specifications, delivery location, budget ceiling, required date, and mandatory eligibility criteria.
The model should not be the source of truth for prices or legal rules. It should retrieve current values through authorised tools and cite the underlying result.
3. WebMCP tool gateway
The gateway publishes narrowly scoped tools with typed schemas. Each tool should define:
- Required and optional inputs.
- Allowed values and length limits.
- Data classification.
- User role requirements.
- Whether the action is read-only, preparatory, or committing.
- Confirmation requirements.
- Rate limits and timeout behaviour.
- The source URL, response timestamp, and trace identifier.
A gateway can also block unsafe tool combinations. For example, an agent might be permitted to search and prepare a comparison, but not call submit_order unless an approval token has been issued for the exact cart, amount, seller, and delivery terms.
4. Browser or approved integration layer
Where an official API or approved integration is available, prefer it over UI automation. If browser interaction is necessary, use a controlled browser session with domain allow-listing, secure cookie handling, CSRF protections, and clear visual indicators when the agent is acting.
Do not bypass CAPTCHA, multi-factor authentication, access controls, rate limits, or portal security mechanisms. Automation must remain consistent with GeM terms, organisational policy, and applicable law.
5. Evidence and audit layer
Store the user request, tool calls, retrieved records, decision criteria, approvals, and final outcome. Record timestamps in a consistent timezone and preserve relevant page or document references. For public procurement, an audit trail is essential for explaining why a listing was shortlisted and who approved a commitment.
Designing safe WebMCP tools for GeM
Tool design determines whether the system is controllable. Avoid a generic tool such as click_anything or execute_javascript. These tools give the model too much power and make testing, approval, and incident investigation difficult.
A better search tool might use a schema like this conceptually:
{
"query": "network firewall",
"category": "approved-category-id",
"specifications": {
"throughput_gbps_min": 10,
"ports_min": 8
},
"delivery_pincode": "110001",
"budget_inr_max": 500000,
"page_size": 25
}The service should validate the schema, reject unknown fields where appropriate, sanitise search text, and return structured results. Each result should contain the listing identifier, seller details, price basis, taxes where shown, stock or availability indicator, delivery estimate, warranty, source URL, and retrieval timestamp.
For comparison, preserve raw values and show how normalisation was performed. Do not allow the model to silently infer that two technical terms are interchangeable. If a requirement is ambiguous, return a clarification request or flag the result for technical review.
A compliant end-to-end workflow
Step 1: Capture the procurement intent
Ask the user for the department or organisation context, item or service, quantity, mandatory specifications, preferred or required delivery location, budget, required delivery date, and procurement route. Identify whether the user wants information, a shortlist, a draft note, or a transaction.
The agent should restate the request before searching. This creates an early opportunity to correct misunderstandings.
Step 2: Verify authority and constraints
Check whether the user is authorised for the requested activity. Apply organisation-specific limits such as spending thresholds, approval levels, restricted categories, and separation of duties. Where the system cannot verify a rule, it should say so and direct the user to the appropriate procurement or finance officer.
Step 3: Search current GeM data
Call a read-only search tool and retrieve multiple relevant listings. Use deterministic filters for mandatory requirements before using semantic ranking. For example, a model may help interpret a natural-language requirement, but the final filter should enforce measurable constraints such as capacity, dimensions, certification, compatibility, or warranty duration.
Step 4: Verify listing details
Fetch the full details for shortlisted items. Check seller information, product specifications, country-of-origin or other displayed declarations where relevant, delivery terms, installation, warranty, taxes, cancellation conditions, and any applicable buyer-specific requirements.
The agent should highlight missing or conflicting fields instead of filling them with assumptions.
Step 5: Generate a reviewable comparison
Produce a table that distinguishes facts retrieved from GeM from model-generated observations. Include listing IDs and source links. A useful comparison may contain:
| Criterion | Listing A | Listing B | Review note |
|---|---|---|---|
| Technical fit | Exact value | Exact value | Mandatory or preferred |
| Total displayed price | INR value and basis | INR value and basis | Confirm at checkout |
| Delivery | Location and estimate | Location and estimate | Verify before approval |
| Warranty/service | Stated terms | Stated terms | Technical review needed |
| Seller information | Retrieved details | Retrieved details | Check eligibility |
Do not rank products solely by lowest price. The buying decision should follow the applicable procurement criteria and the organisation’s documented requirements.
Step 6: Prepare, but pause before commitment
The agent may create a draft cart, draft procurement note, or approval packet if permitted. It should then show the exact item, quantity, seller, price, taxes, delivery terms, and any conditions that will be accepted.
Before any order, bid submission, or other binding action, require a fresh human confirmation. For higher-value purchases, require the designated approval workflow rather than a simple chat confirmation.
Step 7: Record the outcome and monitor
After an authorised action, store the transaction reference and relevant evidence. A separate read-only tracking tool can monitor status, delivery, invoice, or support updates. Notifications should avoid exposing sensitive procurement information through insecure channels.
Human approval and transaction controls
The most important control is a transaction boundary. Define actions that an agent can never complete autonomously and actions that require step-up approval. Examples include:
- Submitting a purchase order or bid.
- Accepting seller terms or a declaration.
- Authorising payment.
- Changing quantity, delivery location, or specifications after approval.
- Cancelling an order or responding to a dispute.
- Sharing restricted tender or budget information.
Use an approval token bound to the transaction hash. The token should expire quickly and become invalid if the amount, seller, item, quantity, or terms change. Display a confirmation summary in a trusted interface—not only in model-generated text—and require the authorised user to approve there.
Security and privacy considerations in India
Apply data minimisation. Send the model only the information needed for the task, and redact personal data, internal file paths, credentials, and confidential commercial information. Classify procurement records according to the organisation’s policies and consider Indian data protection obligations, including the Digital Personal Data Protection Act, 2023, where personal data is processed.
Additional controls should include:
- Encryption in transit and at rest.
- Secret storage outside prompts and logs.
- Tenant isolation for different departments or organisations.
- Prompt-injection detection in seller descriptions and uploaded documents.
- Malware scanning for downloaded files.
- Domain and redirect allow-lists.
- Immutable or access-controlled audit logs.
- Incident response, backup, retention, and deletion policies.
- Rate limiting and circuit breakers for portal instability.
Treat webpage text as untrusted input. A seller description could contain instructions aimed at manipulating the agent, such as asking it to disclose a token or ignore a procurement rule. The tool layer must prevent content from changing system policy.
Testing and evaluation strategy
Test the agent with realistic procurement scenarios, not just successful searches. Build a test set covering:
- Exact and ambiguous specifications.
- No-result and partial-result searches.
- Conflicting price and tax presentations.
- Expired bids and changing availability.
- Unavailable delivery locations.
- Malicious text in listings or attachments.
- Session expiry and MFA prompts.
- Duplicate products and misleadingly similar models.
- Budget and approval-limit violations.
- Portal downtime and rate limiting.
Measure factual accuracy, mandatory-specification recall, unsupported-claim rate, tool failure handling, approval bypass rate, latency, and audit completeness. Run regression tests whenever a tool schema, prompt, browser version, or portal workflow changes.
A useful policy metric is *unauthorised commitment rate*: the number of committing actions completed without the required approval. In a well-designed system, this must be zero.
Common implementation mistakes
Giving the model unrestricted browser control
This creates an opaque and high-risk automation path. Replace generic clicks with typed tools and an allow-listed action set.
Treating search ranking as procurement justification
A model’s ranking is not a procurement criterion. Require explicit, user-provided criteria and retain the evidence supporting the shortlist.
Assuming portal data is permanent
Prices, availability, delivery estimates, and bid status can change. Retrieve current data at decision time and display timestamps.
Automating around security controls
Do not attempt to evade CAPTCHA, MFA, authorisation checks, or other controls. Design a human-in-the-loop pause for these steps.
Logging sensitive information indiscriminately
Full browser traces may contain tokens, personal data, or internal procurement details. Redact logs and restrict access by role.
Failing silently
If a tool cannot verify a requirement, the agent should mark it as unknown. A visible limitation is safer than a confident but unsupported answer.
Practical technology checklist
Before deploying a WebMCP-enabled GeM assistant, confirm that you have:
- A documented list of permitted use cases.
- Official or approved access methods where available.
- Typed, least-privilege tools.
- Separate read, prepare, and commit permissions.
- Role-based access and step-up approvals.
- Secure session and secret management.
- Source citations and retrieval timestamps.
- Prompt-injection and file-safety controls.
- Comprehensive audit logs.
- Human escalation for ambiguous or high-risk cases.
- Automated tests and a rollback plan.
- A process for reviewing GeM, legal, financial, and organisational policy changes.
The goal is not to make an AI agent independently purchase anything it can find. The goal is to reduce repetitive research and paperwork while improving traceability, consistency, and decision support for authorised procurement teams.
FAQ: WebMCP and AI agents on GeM
Can an AI agent place a GeM order automatically?
It should not do so by default. Use human approval and organisation-specific financial controls for any binding purchase, bid submission, payment, or acceptance of terms.
Is WebMCP the same as scraping GeM?
No. WebMCP is a structured tool interface for agent actions. Scraping may violate access rules and can be fragile. Use official APIs, approved integrations, or compliant browser workflows where available.
What should the agent do when product specifications are unclear?
Ask a clarification question or flag the listing for technical review. It should not infer compliance from marketing language or substitute a similar specification without approval.
Can WebMCP work with existing procurement software?
Yes. A WebMCP gateway can connect an agent to approved internal systems for requirements, approvals, budgets, and records, while keeping GeM access controlled and auditable.
What is the safest first use case?
Start with read-only catalogue search, summarisation, comparison, and order-status tracking. Expand only after accuracy, security, compliance, and approval controls have been tested.
Apply for AI Grants India
Building a compliant AI agent for GeM procurement or another high-impact Indian workflow? Apply to AI Grants India for support, visibility, and potential grant opportunities for your product.