Forward-compatible discoverability profile + signed reference at getspeakable.ai
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 25/100
- Issue 类型
- 功能
- 描述清晰度
- 需要澄清
- 活跃度
- 停滞
- 技术栈
- html, json
- 领域
- api, documentation, security
调研方向
Read the repository README and the linked WebMCP v1 specification, then compare the proposal with issues #131, #51, #88, and #105. The proposal identifies the /.well-known/webmcp.json manifest and <link rel="webmcp-manifest"> fallback, but does not identify an implementation file or agreed change for this repository. Completion would require the maintainers to decide whether this belongs in the CG roadmap and, if so, specify the normative text or implementation work.
由索引模型根据 Issue 内容生成。
描述
The README lists "Enable/influence discoverability of sites to agents" as a non-goal, and issue #131 addressed local auto-registration rather than cross-origin pre-flight discoverability. In the meantime, production deployments building for agentic-commerce workloads — especially transact-class tools — are hitting a concrete operational gap: agents can't plan before loading the page, and there's no cryptographic way to verify that a registered tool came from the domain operator rather than a third-party script (tag manager compromise, supply-chain injection).
We've published a forward-compatible profile and a live signed reference implementation that may be useful input if / when the CG decides to revisit this as a goal:
- Spec: https://getspeakable.ai/spec/webmcp-manifest-v1
- Live signed manifest (our own): https://getspeakable.ai/.well-known/webmcp.json
- Trust cert showing webmcp cross-reference: https://getspeakable.ai/.well-known/speakable-trust.json
Design choices aimed at round-tripping cleanly into whatever the CG eventually adopts:
| Concern | Approach |
|---|---|
| Location | /.well-known/webmcp.json + <link rel="webmcp-manifest"> fallback |
| Integrity | JCS (RFC 8785) canonical body, Ed25519 signature with signature removed from payload |
| Key reuse | Same key chain as Web Bot Auth (RFC 9421 / IETF HTTP Message Signatures) and JWK Thumbprint (RFC 7638) — origins signing for WebMCP don't need a new key |
| Risk taxonomy | riskClass: read / mutate / transact / escalate — maps onto where agent.requestUserInteraction() should gate |
| Drift | Runtime tool inventory from provideContext() / registerTool() reconciled against manifest; mismatch on transact / escalate halves trust weight |
| Forward compat | Field names + JSON shapes chosen so a v1.1 alignment to CG-adopted discoverability is losslessly migratable |
Happy to contribute normative spec text or implementation reports if any of this maps to where the CG is heading. Either way, the reference is available to point at from discoverability-adjacent threads (#51, #88, #105) so there's a concrete working example on the table.
—
Disclosure: I'm shipping this through https://getspeakable.ai — a certification platform scoring businesses for AI commerce readiness. The manifest is open-spec; anyone can implement and verify without us.
- 主要语言
- Bikeshed
- 星标
- 4.7k
- 派生
- 328
- 平均合并
- 2 天 15 小时
- 30 天内合并 PR
- 16
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
webmachinelearning/webmcp 的其他 Issue
-
难度 1/5 1-3 小时 新手友好度 72/100
webmachinelearning/webmcp#360 ·
维护者通常 1 天内回复
-
Say how an agent should weigh annotations that the page wrote about itself可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
webmachinelearning/webmcp#353 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 67/100
webmachinelearning/webmcp#343 · 1 个 reaction ·
维护者通常 1 天内回复
-
Agenda+ i18n-tracker
难度 2/5 1-3 小时 新手友好度 75/100
webmachinelearning/webmcp#273 · 3 条评论 ·
维护者通常 1 天内回复
-
a11y-tracker Agenda+
难度 2/5 1-3 小时 新手友好度 67/100
webmachinelearning/webmcp#272 · 4 条评论 · 2 个 reaction ·
维护者通常 1 天内回复
查看 webmachinelearning/webmcp 的全部 Issue
相似的 Issue
-
bug
难度 2/5 1-3 小时 新手友好度 72/100
ansys/pyansys-common-mcp#213 ·
维护者通常 3 天内回复
-
难度 2/5 1-3 小时 新手友好度 83/100
-
bug
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复
-
priority:P1 status:in-review type:bug
难度 2/5 1-3 小时 新手友好度 75/100
randomparity/kdive#3317 · 1 条评论 ·
维护者通常 1 天内回复
-
bug medium-priority mobile
难度 2/5 1-3 小时 新手友好度 76/100
lognorman20/monaco#6229 ·