Merge branch 'main' of github.com:webmachinelearning/webmcp into events

Author: beaufortfrancois

docs/proposal.md

@@ -40,7 +40,7 @@ Handling tool calls in the main thread with the option of delegating to workers
 - **Fine-grained permissions**: Tool calls are mediated through the browser, so the user has the opportunity to review the requesting client apps and provide consent.
 - **Developer involvement**: Encourages developer involvement in the agentic web, required for a thriving web. Reduces the need for solutions like UI automation where the developer is not involved, improving privacy, reducing site expenses, and a better customer experience.
 - **Seamless integration**: Since tool calls are handled locally on a real browser, the agent can interleave these calls with human input when necessary (e.g. for consent, auth flows, dialogs, etc.).
-- **Accessibility**: Bringing tools to webpages via may help users with accessibility needs by allowing them to complete the same job-to-be-done via agentic or conversational interfaces instead of relying on the accessibility tree, which many websites have not implemented.
+- **Accessibility**: Bringing tools to webpages via WebMCP may help users with accessibility needs by allowing them to complete the same job-to-be-done via agentic or conversational interfaces instead of relying on the accessibility tree, which many websites have not implemented.
 
 ## Limitations of this design
 
@@ -54,27 +54,30 @@ Handling tool calls in the main thread with the option of delegating to workers
 ### modelContext
 The `window.navigator.modelContext` interface is introduced for the site to declare functionality that can be used by an AI Agent. Access to these tools is arbitrated by the browser.
 
-The `modelContext`'s `registerTool()` and `unregisterTool()` methods are used to add and remove tools from the agent's context.
+The `modelContext`'s `registerTool()` method is used to add and remove tools from the agent's context.
 
 ```js
-window.navigator.modelContext.registerTool({
-      execute:
-        ({ text }, agent) => {
-          // Add todo item and update UI.
-          return /* structured content response */
-        },
-      name: "add-todo",
-      description: "Add a new todo item to the list",
-      inputSchema: {
-        type: "object",
-        properties: {
-          text: { type: "string", description: "The text of the todo item" }
-        },
-          required: ["text"]
-        },
-    });
+const addTodoTool = {
+  execute: ({ text }, agent) => {
+    // Add todo item and update UI.
+    return /* structured content response */
+  },
+  name: "add-todo",
+  description: "Add a new todo item to the list",
+  inputSchema: {
+    type: "object",
+    properties: {
+      text: { type: "string", description: "The text of the todo item" }
+    },
+    required: ["text"]
+  },
+};
+const controller = new AbortController();
+
+window.navigator.modelContext.registerTool(addTodoTool, { signal: controller.signal });
 
-window.navigator.modelContext.unregisterTool("add-todo");
+// Unregister tool later...
+controller.abort();
 ```
 
 ### agent

docs/security-privacy-considerations.md

@@ -360,6 +360,14 @@ To advance the security and privacy posture of WebMCP, we need community input o
 
 **How:** Ensuring an interoperable basis for prompt injection defense, by requiring any implementer to protect against at least the attacks in that dataset
 
+#### [Untrusted Annotation for Tool Responses](https://github.com/webmachinelearning/webmcp/issues/136)
+
+**What:** Giving agents information about trust boundaries such as highlighting untrustworthy content to the model using an untrusted annotation.
+
+**Threats addressed:**  Prompt Injection Attacks (Output Injection Attacks)
+
+**How:** A boolean `ToolAnnotations.untrustedContentHint = true` annotation that acts as a signal to the client that the payload requires heightened security handling, allowing the client to sanitize the payload, use indicators such as spotlighting to highlight untrustworthy content to the model, or hide that part of the response entirely.
+
 ... add more issues here
 
 ## Next Steps