E7 · Fix the cancellation
15 minPut consequentialHint and the confirmation in cancelar_agendamento and run the check afterward block.
Done when: RESULTADO: 0 falhas and saída: 0.
Lesson 3 · 18 min
An action with consequences needs a human: confirmation and consequentialHint
Booking, canceling, paying, deleting. The agent may pick the wrong tool, misread the description, or obey planted text. The WebMCP spec answers with consequentialHint, so the client can require confirmation. In this lesson you add the annotation and your site's own confirmation, and you prove that declining changes nothing.
Start the lesson
In this lesson you will
- 1Misdescribed intent: the spec's finalizeCart case
- 2consequentialHint (a signal for the client) and the site's confirmation (your lock)
- 3The test that declines and checks that nothing changed
- 4The limit: an agent that operates the screen can click the button too
Goal: add consequentialHint and a confirmation with target and effect to every tool that changes something, and prove that declining changes nothing.
01From request to effect, with a person in the middle
Tap each step.
Click each block in the diagram to see what it does.
The annotation is for the client; the confirmation is yours. One doesn't replace the other.
02Confirmation that protects
1. Target and effect
The question says what, whose, and what happens next. "Are you sure?" won't do: the person doesn't know what they're approving.
2. Tied to the call
One question per call, with that call's arguments. If the target changes, it's a new question. Never a "yes" that covers the next ones.
3. A name that states the effect
The spec shows finalizeCart: the agent thought it was only closing the cart to look, and the tool made the purchase (§6.3.2.3). Name and description state the effect: comprar_carrinho, "charges the saved card".
4. The limit
The dialog lives on the page, and an agent that operates the screen can click Confirm too. checar.mjs itself clicks, the way an agent would. For a high-value action, ask for something the agent doesn't have: the password again, or a code sent to the person.
03The second hole: canceling without asking
Edit cancelar_agendamento in kit/pagina/ferramentas.mjs as in the snippet and run the checker. The finished version is in kit/solucao/aula3/.
Snippet · kit/solucao/aula3/ferramentas.mjs
annotations: { consequentialHint: true }, // lesson 3: warns that the action has consequences
execute: util(async ({ codigo }, { signal }) => {
const ag = agenda.agendamentos().find(a => a.codigo === codigo);
if (!ag) throw new Error(`agendamento não encontrado: ${codigo}`);
// the question states the target and the effect in full; aborting the run (signal) counts as "no"
const ok = await ui.pedirConfirmacao(`Cancelar o agendamento ${ag.codigo} (${ag.id}, ${ag.nome})? A vaga volta para a agenda.`, signal);
if (!ok) return { cancelado: false, motivo: 'a pessoa recusou na tela' };
agenda.cancelar(codigo);
ui.atualizar();
return { cancelado: true, agendamento: ag };
})Terminal · check afterward
cd ~/projetos/formacao-webmcp-seguranca-v72/kit node scripts/checar.mjs; echo "saída: $?"
Example from the repository
== Chromium 156.0.8078.4 (Playwright) · modo: nativo ok buscar_mentorias: só leitura, sem texto de terceiro ok ler_avaliacoes: devolve texto de terceiro e está marcada com untrustedContentHint ok meus_agendamentos: só leitura, sem texto de terceiro ok agendar_mentoria: consequentialHint + confirmação; recusar não mudou nada ok cancelar_agendamento: consequentialHint + confirmação; recusar não mudou nada RESULTADO: 0 falhas saída: 0
Before the fix, the same line said FALHA cancelar_agendamento: agiu sem pedir confirmação (output from lesson 2).
04Practice
The lock, in the kit and on your page.
E8 · Break it on purpose
5 minIn agendar_mentoria, replace const ok = await ui.pedirConfirmacao(…) with const ok = true and run the checker. Then undo it.
Done when: FALHA agendar_mentoria: agiu sem pedir confirmação and saída: 1; once undone, RESULTADO: 0 falhas.
E9 · Inventory of your site
20 minList the tools on your site that change something. Each one gets consequentialHint: true and a question that names the target and the effect.
Done when: grep -c "consequentialHint: true" [your tools file] → the number of tools on your list.
05Lesson quiz
Question 1 of 4
What does the spec say the client can do when it sees consequentialHint?skill
Correct
§6.4.5: the signal lets the client require confirmation selectively. It is something the client may do, so the site needs its own confirmation.Not this one
§6.4.5: the signal lets the client require confirmation selectively. It is something the client may do, so the site needs its own confirmation.Review: From request to effect, with a person in the middleQuestion 2 of 4
Which confirmation question actually protects?
Correct
Target and effect spelled out, one question per call. The others ask for a yes without saying what for, or a yes that covers many actions.Not this one
Target and effect spelled out, one question per call. The others ask for a yes without saying what for, or a yes that covers many actions.Review: Confirmation that protectsQuestion 3 of 4
Why does the course say confirmation on the page has a limit?
Correct
checar.mjs clicks the button, as an agent would. For a high-value action, ask for something the agent does not have.Not this one
checar.mjs clicks the button, as an agent would. For a high-value action, ask for something the agent does not have.Review: Confirmation that protectsQuestion 4 of 4
In the spec's finalizeCart case, what went wrong?
Correct
Misrepresented intent (§6.3.2): the agent read "finalizes the cart" as "shows the cart". The name and description must state the effect.Not this one
Misrepresented intent (§6.3.2): the agent read "finalizes the cart" as "shows the cart". The name and description must state the effect.Review: Confirmation that protectsQuiz complete
You got {a} of {n} right. Get them all right and the lesson is marked as complete.Choose an answer. The explanation appears after you try.
06In three sentences
AnnotationconsequentialHint on every tool that changes something.
ConfirmationFrom the site, with target and effect, one per call; refusing changes nothing.
LimitA button on screen is one the agent also clicks; high value calls for what only the person has.