Add security and privacy questionnaire

[victorhuangwq]

Addresses #193

cc: @bwalderman @johannhof @domfarolino

[domfarolino]

Link to https://webmachinelearning.github.io/webmcp/#dom-modelcontextregistertooloptions-exposedto

[domfarolino]

Suggested change

	WebMCP exposes author-defined tool metadata and tool return values to the user agent. It does not expose new information about the user or their environment to origins.
	WebMCP exposes author-defined tool metadata and tool return values to the built-in AI agent. It does not expose new information about the user or their environment to origins.

[domfarolino]

Suggested change

	Yes. The API surface exposes only what is necessary for agents to discover and invoke tools. The information that flows through tool parameters and return values is entirely scoped to what the author declares.
	Yes. The API surface exposes only what is necessary for agents to discover and invoke tools. The information that flows through tool metadata like parameters and annotations, as well as tool return values, is entirely scoped to what the author declares.

[domfarolino]

Suggested change

	No, the API itself does not expose PII.
	No, the API itself does not expose PII, but the tools that authors choose to implement _can_, depending on their nature.

[domfarolino]

Suggested change

We note a novel challenge for agent implementors: malicious tools can request a non-minimal set of personal data via their input parameters, causing privacy leakage. See [Privacy Leakage through Over-Parameterization](https://w3c.github.io/webmcp/#privacy-leakage-over-parameterization) for details. WebMCP does not increase the attack vector compared to tools in non-WebMCP contexts, but implementors should be aware that this risk exists.

We note a novel challenge for agent implementers: malicious tools can request a non-minimal set of personal data via their input parameters, causing privacy leakage. See [Privacy Leakage through Over-Parameterization](https://w3c.github.io/webmcp/#privacy-leakage-over-parameterization) for details. WebMCP does not increase the attack vector compared to tools in non-WebMCP contexts, but agent implementers should be aware that this risk exists.

small nit: https://whatwg.org/style-guide#dictionary

[domfarolino]

Suggested change

	No. Tool `execute` callbacks are ordinary JavaScript invoked in the registering document's existing realm.
	No. Tool [`execute`](https://webmachinelearning.github.io/webmcp/#dom-modelcontexttool-execute) callbacks are ordinary JavaScript invoked in the registering document's existing realm.

If we keep this answer, I have the suggestion above. However, I think there's a chance we might want to say "Yes" to this question, since we're basically introducing a structured postMessage() v2, which allows a set of authorized origins to basically directly schedule callbacks in the tool provider's realm, which is kind of "new" on the platform. Since this is relevant to the TAG review we'll file, let me just ask @jyasskin directly: what do you think our answer should be for this question?

[domfarolino]

Suggested change

	The feature is gated by Permissions Policy `"tools"`. It is allowed in top-level documents and same-origin descendants by default; Permissions Policy can be used to allow it in cross-origin iframes and/or to disallow it in same-origin frames.
	The feature is gated by the [`"tools"`](https://webmachinelearning.github.io/webmcp/#permissiondef-tools) permission policy. It is allowed in top-level documents and same-origin descendants by default; The permission policy can be used to allow it in cross-origin iframes and/or to disallow it in same-origin frames.

[domfarolino]

Link to exposedTo again.

[domfarolino]

Also add a note about how a document cannot register tools while in the bfcache, nor can it retrieve the list of tools available to it.

[domfarolino]

This is not spec'd yet, so let's make a note that this will be the case, but the spec needs to catch up. And let's clarify that "abandoned" means that:

• In-page agents: the caller's Promise will be rejected
• Built-in agents: the agent will be notified that the tool call failed.