Chrome for Developers: How to build safer WebMCP tools for AI agents

Are your WebMCP tools secure against unintended actions or prompt injections



Learn how to build safer tools to protect your web applications and user data. Discover how to add annotations directly to your tool definitions, like consequentialHint for high-stakes operations, readOnlyHint to reduce permission pop-ups, and untrustedContentHint to safeguard against indirect prompt injections by indicate that tool outputs contain untrusted content that requires data spotlighting.



You can inspect all of these security hints directly inside Chrome DevTools.



Resources:

WebMCP example agentic extension on GitHub → https://goo.gle/4zDeSbM

Tips for safer WebMCP tools → https://goo.gle/4ibpxDG

Security demo → https://goo.gle/4yE7BYp

Agent security for WebMCP → https://goo.gle/4sdXCYl

WebMCP documentation → https://goo.gle/webmcp-docs

WebMCP and agents → https://goo.gle/4k4TxDx



Subscribe to Chrome for Developers → https://goo.gle/ChromeDevs



#Chrome #ChromeforDevelopers #WebMCP #ChromeDevTools





Speakers: Kasper Kulikowski, Maud Nalpas

Products Mentioned: WebMCP, Chrome DevTools