Security and Trust Between Site and Agent|INEMA.CLUB-PRO

WebMCP Track · course 4 of 6 · 8 lessons

Security and trust between your site and agents

Prompt injection has no fix, and the vendors say so themselves. What you can do is decide what the agent sees, what it can do without you, and how your server refuses what isn't its own. Eight lessons, each with an attack running on your machine and the control that stops it.

Start with lesson 1 See the track area
Security and trust between site and agent: dark monitor with a form and a padlock, a cable plugged in beside it.
  • 8short lessons
  • 7exposure cases measured in Chromium
  • 6attacks on the MCP server in the kit
  • 0API keys and cost

The lessons

Each lesson ends with a command you run and an output that checks out. The kit is in the course's own repository.

  1. Lesson 1 · 15 minPrompt injection has no fix: what Anthropic and OpenAI sayNo vendor promises that the agent resists prompt injection. Anthropic said so with a number on November 24, 2025. In this lesson you see the three attack paths the WebMCP spec describes, and you prove, with a word filter, why blocking text doesn't solve it.
  2. Lesson 2 · 18 minPage data is never an instruction: untrustedContentHint and spotlightingReview, comment, forum post: text a visitor wrote and your tool returns to the agent. The WebMCP spec has an annotation to flag this, untrustedContentHint, and leaves the handling to the client. In this lesson you find these tools with a canary and mark each one.
  3. Lesson 3 · 18 minAn action with consequences needs a human: confirmation and consequentialHintBooking, canceling, paying, deleting. The agent may pick the wrong tool, misread the description, or obey planted text. The WebMCP spec answers with consequentialHint, so the client can require confirmation. In this lesson you add the annotation and your site's own confirmation, and you prove that declining changes nothing.
  4. Lesson 4 · 18 minWho sees the tool: same origin, exposedTo, iframes and Permissions-PolicyBy default, only the page itself and same-origin pages can see the tool. An iframe from another origin shows up to the top page only with three consents, and a header turns everything off. In this lesson you measure the seven cases in Chromium and put Permissions-Policy: tools=() on the pages that do not need WebMCP.
  5. Lesson 5 · 20 minSecure MCP server: audience, minimum scope, handle tied to the user, and secret kept out of the repoYou built the server's OAuth in course 1. Here is the other side: six attacks from the MCP security list (revision 2026-07-28) against the same server, written two ways. You see what the official SDK blocks on its own and what it only blocks if you configure it.
  6. Lesson 6 · 18 minIdentifying who arrives: Web Bot Auth and signed agents (IETF draft)Anyone can write a User-Agent. Web Bot Auth is the IETF proposal for a bot to sign each request with a key published at its own URL. It is still a draft (-00, September 2026). In this lesson you check a signature against the draft's test vector and see on a local server what it proves and what it doesn't.
  7. Lesson 7 · 20 minThreat modeling for a toolThe course organizes the threats in §6.3 of the WebMCP spec into seven categories (the three vectors in §6.3.1 and sections 6.3.2 to 6.3.5), and the spec admits there is no way to verify that the tool does what it says. In this lesson you run the catalog through a linter that finds the obvious and fill in the threat card that covers the rest.
  8. Lesson 8 · 20 minSecurity audit of your site and serverSix checks, one per lesson, in a single run with a dated report. You run the audit on the kit, plant a secret to see the break get caught, and leave with the review plan: the spec changes, the dependencies change, and the audit runs again.

Who it's for

  1. 1People who have already done courses 1 to 3 of the track (MCP server, WebMCP on the page, browser agents) or who already have tools exposed to agents.
  2. 2Web devs or technical site owners who will let an agent act on the visitor's behalf and want to know where that goes wrong.
  3. 3People who run an MCP server over HTTP and want to check audience, scope, and secret before opening it to the outside.

What you'll be able to do

  1. 1Mark third-party text with untrustedContentHint and use a canary to prove that no tool leaked.
  2. 2Add confirmation with target and effect to every action with consequences, and test that declining changes nothing.
  3. 3Measure who sees each tool (iframe, exposedTo, fromOrigins) and turn WebMCP off with Permissions-Policy.
  4. 4Run 6 attacks against an MCP server, check a Web Bot Auth signature, and close with the audit of your site.

Where this course fits in the WebMCP Track

  1. 1Course 1 teaches the MCP server and OAuth; course 2, the WebMCP API on the page; course 3, the agent that uses the site. Here is the threat side of all three.
  2. 2Course 5 (expert) brings it all together in production, with observability and governance.
  3. 3Lethal trifecta, injection against an agent, and loop sandbox are in the LOOP-R Engineering Track (link in lessons 1 and 8).