Self-attacked WebMCP setup: agent trusted a readOnly label on a delete_all_data tool
ialijr · reddit · 2026-10-24
A developer who built both sides of WebMCP and attacked his own setup argues you should think twice before adding WebMCP support. The spec's own security section admits a tool's declared intent may not match its actual behavior.
The risks in practice:
- Every tool runs inside the user's logged-in session — purchases, transfers, deletions need no credentials because cookies are already there.
- Safety labels like readOnlyHint are written by the page itself and verified by no one.
- Pages can add or swap tools mid-session, after the user has agreed.
In his test, a page registered a tool named deletealldata labeled read-only — and his agent trusted the label and picked it. He published a full guide on what to weigh before adopting WebMCP and is asking whether anyone is shipping WebMCP tools behind a login yet.
More from coding & agent
- Claude Code project structure explained: CLAUDE.md, commands, skills and agents — Aiden_Tech_Ai · 2026-10-24
- Claude Duet is a Claude Code session: model and effort controls exposed — brandon_galang · 2026-10-24
- Dev compiles incident-triage SOP into a fine-tuned 3B model: 93% accuracy at 8.4x lower cost — arpit_bhayani · 2026-10-24
- Dev builds downhill skateboarding game Cruising Bones in 10 days with Claude Code — Apprehensive-Law77 · 2026-10-24
- PL researchers welcome AI verification: 'people want confidence, not proofs' — xennygrimmato_ · 2026-10-24
- 5,000 insecure vibe-coded apps later: the security check to run before every launch — PrajwalTomar_ · 2026-10-24