Each control has a stable ID, severity, and evidence state. A result is a signal for review, not a claim that the condition is exploitable. The registry is versioned as webmcp-assurance/1.
WEBMCP-05 · Durable/resource-consuming mutation lacks visible confirmation boundary
CRITICALA tool performs a durable, resource-consuming, or otherwise destructive mutation without a visible human confirmation step.
Negative evidence: Every mutation tool in supported files shows an explicit confirmation prompt or is prepared for the user to review before submission.
What to do: Add a visible confirmation step before any durable mutation. For declarative forms, omit toolautosubmit and require the user to click Submit.
WEBMCP-01 · WebMCP annotation/behavior mismatch
HIGHA tool claims to be read-only or safe but its implementation performs mutation, network calls, or handles untrusted content inconsistently with its annotations.
Negative evidence: Every tool's readOnlyHint, untrustedContentHint, and behavior classification are consistent with its execute body and schema.
What to do: Align the tool's annotations with its behavior. Add untrustedContentHint for externally sourced output and remove readOnlyHint when the tool mutates state.
WEBMCP-03 · Unsafe or dynamic cross-origin tool exposure
HIGHA tool is exposed to an untrusted origin, a wildcard, or a value that cannot be resolved at analysis time.
Negative evidence: Every exposedTo value is a precise same-origin or explicitly trusted origin list and is not dynamic.
What to do: Scope exposedTo to the minimum required origins. Replace dynamic or wildcard exposure with an explicit allowlist.
WEBMCP-04 · Explicitly unsafe tool permissions or disabled origin isolation
HIGHThe site or config exposes tools broadly through Permissions-Policy: tools=*, Origin-Agent-Cluster: ?0, document.domain manipulation, or delegated cross-origin iframes.
Negative evidence: No Permissions-Policy wildcard, no OAC ?0, no document.domain assignment, and no delegated tool iframe is present in assessed source.
What to do: Add Origin-Agent-Cluster: ?1, keep Permissions-Policy tools=(self), remove document.domain assignments, and avoid cross-origin tool delegation.
WEBMCP-09 · Weak schema or missing runtime validation at a trust boundary
HIGHA tool accepts structured input without a closed schema, type checks, or a validation library at the trust boundary.
Negative evidence: Every supported tool has a closed object schema and uses explicit runtime validation before acting on input.
What to do: Define a strict JSON Schema, set additionalProperties: false for object inputs, and add runtime validation before using tool input.
WEBMCP-02 · Externally influenced output lacks untrusted content hint
MEDIUMA tool fetches or returns content from an external origin, user, or unvalidated source but does not set untrustedContentHint.
Negative evidence: Every tool that returns external, user-generated, or otherwise unvalidated content sets untrustedContentHint.
What to do: Set untrustedContentHint for tools whose output is sourced from or influenced by external content.
WEBMCP-06 · Sensitive or unbounded input/output contract
MEDIUMA tool accepts or returns unbounded, sensitive, or poorly described data without limits or closed schema constraints.
Negative evidence: Every supported tool schema has bounded string/array lengths, closed object schemas with additionalProperties: false where safe, and descriptions for sensitive fields.
What to do: Add maxLength, maxItems, additionalProperties: false, and clear descriptions. Bound output arrays and mark sensitive parameters.
WEBMCP-07 · Network operation does not forward cancellation
MEDIUMA tool starts a network request but does not pass the AbortSignal through to fetch, leaving in-flight requests after the caller cancels.
Negative evidence: Every supported network call forwards the tool's AbortSignal to the underlying fetch or request.
What to do: Forward { signal } into every fetch call inside the tool's execute body and handle the resulting AbortError.
WEBMCP-08 · Component registration lacks lifecycle cleanup
MEDIUMA tool is registered inside a component or effect without a corresponding cleanup that unregisters it when the context is destroyed.
Negative evidence: Every supported registration returns or uses an AbortController/abort handler that unregisters the tool on cleanup.
What to do: Store the registration handle and unregister it in the component or effect cleanup path.
WEBMCP-10 · Duplicate, overlapping, ambiguous, or misleading tool contract
MEDIUMTwo or more tools share a name, have misleading titles or descriptions, or overlap so much that an agent cannot choose safely.
Negative evidence: Every tool has a unique name, a clear title and description, and a distinct purpose.
What to do: Rename, merge, or clarify duplicate tools so each has a unique name and a distinct, honest description.
