WebMCP tool official reference-app
Risk level
low
10/100

Le Petit Bistro

Le Petit Bistro is an officially published WebMCP tool from GoogleChromeLabs. Anomity scores its risk at 10 out of 100 (low).

browser:control

Analysis summary

Le Petit Bistro is an officially published WebMCP tool from GoogleChromeLabs. Anomity scores its risk at 10 out of 100 (low).

The canonical declarative-API demonstration: a restaurant booking page whose ordinary HTML form is annotated so that its validation rules and submit action become a WebMCP tool. No JavaScript tool definitions, just markup an agent can read.

It matters because the declarative path is the one most sites will take — annotating forms is cheap, and every form on the web is a candidate. That is also the concern: form annotation turns existing submit handlers into agent-callable endpoints, and most sites have more forms than they remember. It declares browser control. Before annotating, enumerate what each form actually triggers; "book a table" and "cancel subscription" are the same shape in HTML.

Why this entry scored 10 out of 100

This profile starts at the catalog's neutral base of 50. Because the entry is officially published, trust adjusts the score by -40. The entry declares no high-risk capabilities on its own, so capabilities add nothing. It matches no dangerous capability combinations. The clamped result is 10, placing it in the low band.

See the full scoring formula →

Findings

  • Published by the vendor Trust offset
    Contribution to score: -40

Capabilities

Every capability the entry declares, with the security implication of each.

  • browser:control Browser control
    Drives a browser session. Combined with credential access can impersonate the user on web services.