Proposal: Treat hidden and visible elements in declarative MCP differently

[bvandersloot-mozilla]

From a security/privacy perspective, significant improvements in user understanding are available if the elements to be "filled out" are something displayed to the user. I view it as a positive to try to align the agent's activities to things that are comprehensible to the user, particularly in the context of trying to gate tool calls on user permission. One could imagine some really nice user experiences that work how password managers do now: not putting the data into the DOM until the user interacts w

I'm not sure which disparate treatment is appropriate here. This may be a question of agent implementation and just need to be made visible in the as-of-yet undefined tool-use interfaces. However, if this ends up being the case, it'd be nice to drop notes in to the declarative tool definition referencing this.

[victorhuangwq]

I haven't been looking at the declarative MCP as closely as I wished. I would actually think there's a bit of a risk factor if hidden / invisible form elements can be declared, and agents can be made to fill it up on the user's behalf.

[johannhof]

One thing that's not clear to me - would browsers treat the imperative variant differently then, i.e. as less secure in some way? I think if the idea is allowing for different levels of friction between imperative and declarative then I agree it might make sense to keep the declarative variant from taking actions that are invisible to the user.

[bvandersloot-mozilla]

I would not draw the line specifically at declarative vs imperative. But declarative + some visibility requirements would be the useful property to help reduce friction.

[johannhof]

These two sentences seem contradictory :)