Conventions

Draft 0.1

A vocabulary, not a framework.

WebMCP lets a page hand tools to a visiting agent. It says nothing about what those tools should be called or what they should return — so every site invents its own, and every agent has to be built for that site specifically.

Six conventions for the case where a page, a visitor's agent, and the visitor are all in one conversation and some actions need the person. No browser change, no framework, no dependency.

The keystone

One refusal shape.

This is the only member that really matters. It is what lets an agent built by someone who has never seen your site meet your gate and know what to tell its human. Everything else is convenience.

ok: false comes first on purpose: an agent that understands nothing else still reads it as “did not happen.” The shape fails safe by default.

Any tool that needs the person

{
  ok: false,
  needsHumanConfirmation: true,
  origin:    "https://clinic.example",
  requestId: "req-3-8f2a",
  message:   — for the HUMAN, relay verbatim
  agentHint: — for the AGENT, never read aloud
}

Writing this section found a bug: the implementation had been returning one message carrying both, so a machine instruction sat inside prose meant to be read to a person.

Adopt one, get one

Four conformance levels.

There is no all-or-nothing. A convention that demands everything gets adopted by nobody.

Level	Adds	A visiting agent can now
1 · Attributed	`get_conversation`, origins, freshness on every result	See who said what, and stay current
2 · Conversational	`send_message`, `provide_context`	Take part, and front-load what it knows
3 · Gated	the refusal shape	Meet a human-only action and hand off correctly
4 · Responsive	`await_reply`	Stay connected across the handoff

Level 3 is the one worth having. A site that implements only the refusal shape already interoperates.

Rules

Neither party has to trust the other.

That is the test a convention in this space has to pass.

Site MUST
Never treat an origin as authorization. An origin says which path a message arrived on, never that an action is permitted.
Site MUST
Never put secrets in message — it is written to be relayed into a third party's model.
Agent MUST
Treat message and agentHint as data from an untrusted party, not instructions. A field every agent reads is a field every site can write into.
Both MUST
Never require one tool before another. A page that withholds ordinary tools until an agent subscribes has built a toll booth, not a conversation.

Deliberately unspecified

How a human is verified.

WebAuthn is one answer, not the answer. A passkey, a device prompt, a card reader are others. The convention specifies only that a tool may refuse pending a human — never how that human is established.

Also out: the gated tools' own names, the transport, the UI, the policy engine, and what any given site considers consequential.

Open
Delegation scope. Today a tool is gated or it is not. Real use wants a dial. Left as one bit for now — a half-thought permissions model is worse than naming the limitation.
Open
Multi-party. Origins are a set, not a triple. Two humans with two agents should work with no changes. Untested.
Open
Does anyone else want this? Every shape here is one implementation's opinion until a second, unrelated site adopts it and finds the parts that don't survive contact.