Document cross-origin tool exposure and two-sided opt-in in Section 6.3.4

[jpagnucco]

Summary

Replaces the TODO placeholder in Section 6.3.4 (Violation of Same-Origin Boundaries) (#violation-same-origin-boundaries) with documentation covering:

1. Pathways for Same-Origin Boundary Risks:
   • Direct cross-document / cross-origin tool exposure via getTools() and executeTool().
   • Agent-mediated cross-origin state transfer (noting that this is a general agentic browsing consideration rather than a WebMCP-specific threat).
2. In-Page Cross-Origin Tool Exposure and the Two-Sided Opt-In Model:
   • Embedder Delegation via Permissions Policy (allow="tools"): Gated behind the "tools" policy-controlled feature ('self' default allowlist).
   • Tool Provider Opt-In (exposedTo): Explicit allowlisting of potentially trustworthy origins in ModelContextRegisterToolOptions.exposedTo.
   • Tool Consumer Opt-In (fromOrigins): Explicit opt-in by the caller via ModelContextGetToolOptions.fromOrigins.
   • Rationale and code example illustrating how mutual consent prevents unsolicited tool-list pollution and unauthorized cross-origin tool invocation.

---

Preview | Diff

[anssiko]

@jpagnucco to clear the automated ipr check for this and any future contributions, please check that your W3C account is associated with your GH account. That'll fix it.

[victorhuangwq]

Hey! Thanks for getting the draft started on this @jpagnucco, been left for a TODO for a while. I like the content here, but now that I'm reading the whole section together, the title and framing feel a bit off. Titling it "violation" feels wrong when most of what's described is the careful design that prevents cross-document exposure without permission.

I would prefer to retitle this section to something like "Cross-origin tool exposure" and reorder what you currently slightly have so it leads with the consideration and ends with the residual risk. Roughly:

• Your consideration about same origin policy and the one right after it about what a cross-origin exposure means in the context of webmcp

• How WebMCP helps enforce it, and why that matters: your paragraph on why both sides have to agree, and the code sample.

• And then the residual risk: You already have the agent-mediated one (the non-WebMCP specific one) Is there anything else we should be calling out for the direct exposure path?

[victorhuangwq]

Thanks for the update, this looks good to me! I cross-checked it against the current spec and I didn't spot any inconsistencies.

@domfarolino tagging you for review and merge.

[victorhuangwq]

This is a good callout.