michaelvereb.com WebMCP audit

// Make the tool's effect visible on the page the person is looking at:
// update the same UI your existing human flow uses when your_tool_name runs,
// so the person co-browsing sees what the agent just did.
execute: async (args, { signal }) => {
  const result = await performAction(args, signal);
  renderResultInPage(result); // the human-visible half of the same action
  return result;
}

{ name: "scan_images_c2pa" /* short, unique, verb-based */ }

document.modelContext.registerTool({ /* ... */ }).catch(function (err) {
  console.error("WebMCP registration failed", err);
});

{
  name: "search_portfolio",
  // Declare readOnlyHint: true on tools that truly have no side effects -
  // that is the claim that lets an agent relax confirmation on reads.
  // (false is the default, so declaring it adds no information.)
  annotations: { readOnlyHint: true }
}

{ name: "create_contact_message", annotations: { untrustedContentHint: true } }

{
  name: "scan_images_c2pa",
  // Metadata DESCRIBES the tool - it never addresses the agent reading it.
  // Rewrite any name, description, title, or schema field description that
  // instructs the agent (which tool to prefer, what to output, rules to
  // ignore) so it states what the tool does and what it returns instead.
  description: "Searches the catalog and returns matching items with prices."
}