Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Say how an agent should weigh annotations that the page wrote about itself

未关闭 适合新手
  • 哪里不对？
#353 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

@kenchris 已经在做这个了。

开始于 2026年10月20日。

  • #355 来自 @kenchris —— 未关闭

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
72/100
Issue 类型
文档
描述清晰度
描述清楚
活跃度
活跃
技术栈
markdown
领域
documentation

调研方向

阅读第6.3.2、6.4.4和6.4.5节，以及issue中提到的当前缺口和安全考量。为6.4节的缓解措施起草一段简短的非规范性补充，说明代理应如何处理会提高或降低审查力度的提示，以及页面的来源权限。完成标准是：补充内容涵盖全部三个拟议要点，并将当前缺口与缓解措施指南联系起来。

由索引模型根据 Issue 内容生成。

描述

Summary

The annotations (readOnlyHint, untrustedContentHint, consequentialHint) are written by the page, and agents will use them to decide when to ask the user. The security considerations describe the risk, but the mitigations do not say how much weight an agent should give a hint that the page wrote about itself. I'd like to propose a short, non-normative addition.

What the spec says today

  • 6.3.2: "There is no guarantee that a WebMCP tool's declared intent matches its actual behavior."
  • 6.3.2.4 (Current Gaps) lists "Agents must assume good faith from site developers."
  • 6.4.4 and 6.4.5 call the hints "a signal to the client", and 6.4.5 says clients can use consequentialHint to enforce confirmation prompts.
  • 6.3.2.1 notes that the user's cookies and session state are available to the page, so a tool can do high-privilege actions on that origin.

So the spec says a declared intent may not match the behavior, lists the need to assume good faith as a current gap, and then offers the hints as the mechanism for confirmations. It does not say what an agent should do with that tension, so an implementer has to decide on their own. MCP is clearer: clients must treat annotations as untrusted unless the server is trusted, and its post on annotations as a risk vocabulary says hints inform decisions and only controls enforce them.

Why it matters

Hints do not all carry the same risk when they are wrong.

  • A hint that raises scrutiny (consequentialHint: true, untrustedContentHint: true) can only add friction. An agent can honour it from anyone.
  • A hint that lowers scrutiny (readOnlyHint: true, consequentialHint: false) is a claim by the page about itself. If it is wrong, a tool runs without the user being asked, with the user's session on that origin (6.3.2.1).

Without guidance, agents will make different choices, and a page author cannot know what a hint will do in a given agent.

Proposal

Add a short note to the mitigations in 6.4 (non-normative to start with) saying:

  1. Annotations are advisory. A hint that raises scrutiny may always be honoured.
  2. A hint that lowers scrutiny should not on its own cause an agent to skip a confirmation that it would otherwise require. It may be taken into account together with what the agent knows about the origin and the tool.
  3. A tool runs with the registering page's own reach: the cookies and session of that origin (6.3.2.1), and nothing beyond what scripts in the page already have.

This would also give the "current gaps" in 6.3.2.4 something to point at.

Related: #331 (what consequentialHint covers), #53 (hint semantics and defaults), #288 and #298 (page-side approval steps and write boundaries), #313 (mitigations in general).

主要语言
Bikeshed
星标
4.7k
派生
328
平均合并
1 天 21 小时
30 天内合并 PR
15

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

webmachinelearning/webmcp 的其他 Issue

查看 webmachinelearning/webmcp 的全部 Issue

相似的 Issue

更多 Documentation Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。