nusole.com.au WebMCP audit

// Register tools as soon as they're ready, not behind a deferred/async chunk.
document.modelContext.registerTool({ /* ... */ });

{
  name: "search_catalog",
  inputSchema: {
    type: "object",
    properties: {
      query: { type: "string", description: "What to search for" }
    },
    required: ["query"]
  }
}

{ name: "proceed_to_checkout" /* short, unique, verb-based */ }

{
  name: "browse_store",
  description: "Describe what this tool does, when to use it, and what it returns."
}

{
  name: "browse_store",
  // Declare readOnlyHint: true on tools that truly have no side effects -
  // that is the claim that lets an agent relax confirmation on reads.
  // (false is the default, so declaring it adds no information.)
  annotations: { readOnlyHint: true }
}

{ name: "manage_orders", annotations: { untrustedContentHint: true } }

{
  name: "search_catalog",
  // Metadata DESCRIBES the tool - it never addresses the agent reading it.
  // Rewrite any name, description, title, or schema field description that
  // instructs the agent (which tool to prefer, what to output, rules to
  // ignore) so it states what the tool does and what it returns instead.
  description: "Searches the catalog and returns matching items with prices."
}