Essay · Verification

WebMCP tools need behavioral proof.

Schemas improve discovery. They do not enforce the behavior they describe.

readOnlyHint: true helps an agent choose a tool. It cannot stop a callback from writing to a database, scheduling a delayed charge, opening a popup, or disclosing a private field.

Three layers of confidence

1. Static inspection finds declarations, schemas, and obvious risk signals.
2. Runtime discovery proves the browser exposed the tool the agent expects.
3. Behavioral evidence joins the invocation to authoritative, settled effects and compares them with the reviewed human boundary.

Arena keeps all three, but only the third supports a release verdict. Its static scanner is a preflight, never substituted for execution.

Why the callback receipt matters

The hosted demo previously verified only a server-owned adapter beside a separate WebMCP demonstration. Evidence version 2 closes that gap: human approval issues a single-use lease; the candidate becomes a registered tool; the callback binds the reviewed definition and arguments; and the signed proof commits to the result and backend trace root.

The remaining frontier

Browser-signed invocation provenance, independent agent identity issuers, and cross-company trust networks are still open work. Naming that boundary is more useful than claiming the gap away.