Add security and privacy questionnaire

[victorhuangwq]

Addresses #193

cc: @bwalderman @johannhof @domfarolino

[bvandersloot-mozilla]

One question I anticipate from privacy review is what mitigations for this issue are possible for WebMCP. I agree with Dom: well said to make clear WebMCP isn't creating the problem. However, if there are any locations to tie the agent's hands a bit and make the privacy story better (even on the level of recommendations rather than requirements) that would be an improvement. Alternatively, you should make clear that nothing is actually being done to defend against that attack in the spec with something like ... but that risk is not WebMCP-specific and is therefore not defended against in the design of the API.

[victorhuangwq]

I think we can reference the https://webmachinelearning.github.io/webmcp/#mitigations section to begin with perhaps? We should also update the mitigations to include this #176, as discussed in the CG call.

Beyond that, there will just be things that will be left as recommendations for agent implementers, and thus non-normative in nature. But there should be areas where the API design can help with, and I don't want to close the doors on future mitigations by stating otherwise

[johannhof]

+1 to Victor here, strong normative protection might be difficult, but we should definitely try to add e.g. hints that help the agent manage risky actions.

[domfarolino]

Sounds good, @victorhuangwq do you want to link to the mitigations section in the spec from here then?

[bvandersloot-mozilla]

Linking to mitigations is a fine start.

Just to clear up a couple of misconceptions:

Beyond that, there will just be things that will be left as recommendations for agent implementers, and thus non-normative in nature.

Normative language can include non MUST RFC 2119 terms, like SHOULD and MAY.

But there should be areas where the API design can help with, and I don't want to close the doors on future mitigations by stating otherwise

Saying that you don't do anything about it is not closing the door on future mitigations, particularly if you say so.

[johannhof]

IMO those are two fair points from Ben here :)

[victorhuangwq]

Updated based on feedback.

[bwalderman]

It's good that we're stating we'll continue to look at further mitigations but I agree with Ben we should make the currently limitations explicit here. Something like: "The spec does not currently include normative defenses against this; the mitigations listed are recommendations for agent implementers."

[johannhof]

Sorry for the delay, a few comments but L (pretty) GTM already! :)

[domfarolino]

Overall it looks like we're pretty close, but there are a few open threads to resolve:

• #195 (comment)
• #195 (comment)
• #195 (comment)
• #195 (comment)
• #195 (comment)

[victorhuangwq]

Just merged @johannhof's suggestion.

@domfarolino @bvandersloot-mozilla @bwalderman ready for review and merging.

[anssiko]

This resolution touches this PR, so filing here:

RESOLUTION: The group approves the updated review materials (explainer, S&P considerations, S&P questionnaire). The spec editors will stage the review requests in WebMCP repo for the TAG, Privacy WG and Security WG, ensuring that specific questions or technical issues are highlighted to the reviewers in the appropriate sections of the review requests. (issue #195)

Once this PR is merged it unblocks staging. FYI @domfarolino @bwalderman

[bwalderman]

It's good that we're stating we'll continue to look at further mitigations but I agree with Ben we should make the currently limitations explicit here. Something like: "The spec does not currently include normative defenses against this; the mitigations listed are recommendations for agent implementers."

[bwalderman]

There's one more important addition I'd like to make here.

Violation of Same-Origin Boundaries is admittedly still a TODO in our spec but this is a novel security risk that we should raise to reviewers. Our answer at the moment may be the same as our answer about over-parameterization; that this risk in inherent in agents that can browse multiple origins and exists without WebMCP. We should still flag the issue in this questionnaire though to make sure it receives attention.