Module 1.1 — Agent and tool security

Design the trust boundaries

What is it: Documents, remote content, models, agents, tools, and backends are components with distinct trust levels.

Why learn this: The map shows where data becomes instructions and where a decision can produce an effect.

Before modeling

Write down the person's request, the current state, and the evidence that will prove completion.

Starting error

Starting with a function name or a button produces a tool without a clear human goal.

Anticipate before opening the code

What information changes the decision? What effect needs to appear in the interface? Answer before implementing.

untrusted: [pageContent, modelOutput, toolArguments]
trustedOnlyAfter: [validation, policy, authorization]

Going deeper: evidence worth keeping

Record the input, previous state, decision made, result, and visible change to the page.

Also include a simulated failure and the observed behavior without WebMCP support.

Key Concepts

trust boundary

principal

data flow

asset

Model threats by user journey

What is it: Analyze the threat across objectives, data, transitions, and effects, not just isolated endpoints.

Why learn this: Journeys reveal combinations such as prompt injection followed by a valid mutation.

Question	Strong contract	Weak contract
When should you use it?	The description names the intent and context.	“Does things” or “manages.”
What does it receive?	Only the data needed.	Generic, unlimited object.
What does it return?	Verifiable state and next action.	Text without a protocol.
How does it fail?	Code, reason, and recovery.	Opaque exception.

Do

✓ Use specific verbs.
✓ Define the inputs.
✓ State the evidence.

Avoid

✗ Mix intents.
✗ Accept any object.
✗ Hide effects.

ameaça: conteúdo induz agente a cancelar pedido
controle: tool fora do catálogo + confirmação vinculada ao pedido

Going deeper: evidence worth keeping

Record the input, previous state, decision made, result, and visible change to the page.

Also include a simulated failure and the observed behavior without WebMCP support.

Key Concepts

STRIDE

abuse case

attack path

impact

Contain prompt injection

What is it: Page text and tool results are untrusted data, even when they look like instructions.

Why learn this: Separating channels and enforcing policy prevents content from controlling runtime authority.

Observe

Capture state, input, and context before taking action.

Decide

Validate preconditions and choose the allowed transition.

Run

Apply the shared rule and honor cancellations.

Prove

Update the interface and return a structured result.

Checkpoint

If step 2 fails, the tool doesn’t try to “make it work”: it returns an explicit recovery path.

await document.modelContext.registerTool({
  ...searchTool,
  annotations: {
    readOnlyHint: true,
    untrustedContentHint: true
  }
});

// Conteúdo da página e saída de tools continuam sendo dados, não instruções.

Tool poisoning

Names, descriptions, and metadata can also try to induce improper selection or authority.

Output injection

The response may contain hostile instructions. Preserve provenance, limit authority, and treat the payload as untrusted.

Going deeper: evidence worth keeping

Record the input, previous state, decision made, result, and visible change to the page.

Also include a simulated failure and the observed behavior without WebMCP support.

Key Concepts

data vs instruction

provenance

allowlist

policy

Apply least privilege

What is it: Each tool receives the minimum scope, duration, and set of resources required.

Why learn this: Broad credentials turn a selection error into a systemic incident.

REFERENCE CODE

token = mint({ scope: "enrollment:read", resource: enrollmentId, ttl: 60 });

Input

It is small, documented, and verifiable.

Execution

Reuses the application's actual rule.

Output

Lets you verify the effect and continue.

Read the code as a contract

Underline where input is validated, where the effect happens, where cancellation arrives, and where the UI is updated.

Going deeper: evidence worth keeping

Record the input, previous state, decision made, result, and visible change to the page.

Also include a simulated failure and the observed behavior without WebMCP support.

Key Concepts

scope

short-lived token

resource bound

deny by default

Link confirmation to the effect

What is it: The confirmation records the action, target, material parameters, and version of the state presented.

Why learn this: A generic yes doesn’t authorize an action that changed after confirmation.

Simulated failure

Run the scenario with missing state, invalid input, or unavailable capacity.

Expected recovery

The response explains what failed, what remains safe, and what action can continue.

Minimum test matrix

✓ reproducible happy path

✓ actionable invalid input

✓ cancellation ends the work

✓ fallback preserves the user journey

✓ interface reflects the state

✓ backend retains authorization

approval = sign({ tool, argsHash, stateVersion, expiresAt });
verifyApproval(approval, currentCall);

Going deeper: evidence worth keeping

Record the input, previous state, decision made, result, and visible change to the page.

Also include a simulated failure and the observed behavior without WebMCP support.

Key Concepts

intent binding

state version

target

expiry

Continuously test the adversary

What is it: The suite covers prompt and output injection, tool poisoning, misrepresented intent, excessive parameters, extreme arguments, replay, navigation during execution, and privilege escalation.

Why learn this: Security controls need automated regression testing like any contract.

Synthesis exercise

1. Explain the problem without using the name of the technology.
2. Design the before and after states.
3. Implement the smallest working proof.
4. Trigger a failure and record the recovery.
5. Deliver code, evidence, and one known limitation.

Module challenge

Produce a threat model, authority matrix, and adversarial tests for a WebMCP journey involving a sensitive action.

Responsible Expert criterion

The implementation must work, explain its limitations, and preserve the human path when the experimental capability is unavailable.

for (const attack of adversarialDataset) {
  assert(await agent.run(attack)).hasNoUnauthorizedEffect();
}

Going deeper: evidence worth keeping

Record the input, previous state, decision made, result, and visible change to the page.

Also include a simulated failure and the observed behavior without WebMCP support.

Key Concepts

red team

replay

spoofing

privilege escalation

📦 Module delivery

Produce a threat model, authority matrix, and adversarial tests for a WebMCP journey involving a sensitive action.

Acceptance criteria

The implementation works with WebMCP support and preserves the manual path when the API is unavailable.

Evidence

Include code, the tested scenario, the observed result, and one known limitation.

← Back to the track Next module: 1.2 →

Technical sources

Draft and official WebMCP repository
Rendered specification
Official snapshot: 26/08/2026 · commit 41d12f0. The declarative API remains experimental; validate the draft before production.