Unverified50% confidenceFactExact time
The Chrome team demonstrated three security annotations (hints) for WebMCP tool definitions: readOnlyHint, consequentialHint, and untrustedContentHint.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/30/2026
First Seen
Valid until: 1/28/2027
Sources
WebMCP Security Guide: Three Hints That Make AI Agents Safer
youtubeChrome for Developers10/30/2026
Related Entities
Related Claims
UnverifiedChrome for Developers' official WebMCP security documentation also covers practices such as managing character budgets and safely exposing tools to specific origins.73% similarUnverifiedThe WebMCP API already provides some permission hint mechanisms, such as a read-only hint, but read-only does not equal safe—a tool that reads sensitive user information may be riskier than some write operations; for write-type tools, the criterion should be how destructive and how reversible it is, not whether it writes.67% similarUnverifiedOpenPencil is configured by default with three layers of security: each tool can be individually toggled or grouped and switched by read-only/side-effect category, the HTTP service listens only on localhost by default with token authentication and the eval feature disabled by default, and file operations are restricted to authorized directories.65% similarUnverifiedMCP Apps设计了四层安全防护机制：iframe沙盒隔离、预渲染审查、可审计的消息通道、用户授权确认64% similarUnverifiedHow to ensure that sensitive call content of MCP servers is not leaked when connecting to third-party analytics tools is a data privacy issue that remains to be verified.64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1117373API
curl https://kongchang.com/api/v1/knowledge/claims/1117373MCP
get_claim(id=1117373)