WebMCP Agent Developer

Discovery starts with intent, constraints, and current state, not with blindly enumerating every tool.

A normalized goal reduces noise even before capabilities are presented to the model.

intent · constraints · context · success criterion

Name, description, inputSchema, and annotations form the interface the agent can reason about.

Treating the descriptor as data lets you validate, index, compare, and record decisions.

name · description · inputSchema · annotations

Deterministic rules eliminate tools incompatible with the route, authentication, risk, or entity.

The filter reduces tokens and prevents choices we already know are invalid.

current route · session · risk · precondition

The agent needs short descriptions, complete schemas, and consistent examples, without exposing internal implementation details.

A stable representation improves selection and lets you compare models or prompts.

serialization · context limit · example · redaction

Navigation, login, and selection can change the available tools during the same conversation.

The agent must invalidate snapshots and rediscover capabilities when the document signals a change.

toolchange · snapshot · invalidation · rediscovery

Coverage, precision, and the correct tool in the top k show whether the pipeline retrieves good candidates.

Without discovery evals, a poor final answer may be attributed to the wrong component.

recall · precision · top-k · dataset

The call produced by the model is an untrusted proposal until it passes validation and policy checks.

The boundary prevents probabilistic text from turning directly into an effect.

tool call · untrusted input · policy gate · execution

Even when the provider applies schemas, the runtime validates types, limits, enums, and extra fields.

Defense in depth contains provider discrepancies and calls generated by external code.

JSON Schema · coercion prohibited · limits · stable error

Risk, authentication, scope, and the need for confirmation are decided outside the model.

The LLM can recommend; the application remains responsible for authorization.

authorization · risk · confirmation · scope

Every execution receives an AbortSignal, deadline, and limits suited to the experience.

An abandoned conversation shouldn’t keep the network, UI, or backend working indefinitely.

AbortSignal · deadline · resource budget · cleanup

The runtime converts heterogeneous returns into envelopes with status, data, evidence, and next action.

A common format simplifies the loop without hiding the original error.

envelope · recoverable error · evidence · next action

Each execution links the turn, catalog, proposal, policy decision, duration, and sanitized result.

The trace makes it possible to debug selection, execution, and effects without recording secrets.

traceId · catalog version · latency · redaction

The page, agent, user, and backend have different identities and authorities.

Confusing these identities creates excessive delegation and authorization bugs.

principal · delegation · session · resource

Origin combines scheme, host, and port and defines a central boundary of the Web.

A tool registered by a document doesn’t grant unrestricted access to other origins.

same-origin · scheme · host · port

Embedded frames have their own document, origin, and lifecycle.

The agent needs to know which context provides the tool and where its effect will be visible.

top frame · iframe · sandbox · context id

CORS controls reading by browser scripts; the backend still validates identity and permission.

A response allowed by CORS may still be forbidden for that user and operation.

CORS · credentials · backend auth · CSRF

Sensitive actions require clear confirmation that shows the target, effect, and reversibility.

Generic or advance consent doesn’t cover a specific mutation.

just in time · effect · target · reversibility

The suite covers tool spoofing, navigation during execution, a removed frame, and an unexpected origin response.

Boundaries only truly exist when adversarial paths are exercised.

spoofing · navigation race · frame removal · origin check

Each turn brings together the message, page snapshot, catalog, previous executions, and remaining budget.

An explicit state prevents prompts from being assembled through accidental concatenation.

turn state · page snapshot · history · budget

The loop alternates structured observation, model decision, and controlled execution until it reaches a terminal state.

Separating phases makes testing easier and prevents unbounded recursion.

observe · decide · act · terminal

A task may require search, details, and action, with results informing later decisions.

The runtime must preserve dependencies without letting the model invent an intermediate ID.

dependency · result binding · sequence · parallel safety

Ambiguity, high risk, or a material change of plan creates a confirmation checkpoint.

The pause preserves human agency without breaking the continuity of the turn.

human in the loop · ambiguity · risk · resume token

The response distinguishes what was observed, what was executed, and what still depends on the user.

Transparency reduces false claims of success and builds trust.

grounding · executed effects · pending action · citation

The test measures completion, correct tool, steps, safety, recovery, and response quality.

Evaluating only the final text hides unnecessary or dangerous calls.

task success · tool accuracy · step count · safety