From 3ef6de338040917d1d1b4caffdd553f9cae53e15 Mon Sep 17 00:00:00 2001
From: Kenneth Rohde Christiansen <kenneth.christiansen@gmail.com>
Date: Tue, 20 Oct 2026 12:22:30 +0200
Subject: [PATCH 1/2] Say that a hint a tool leaves out is not an assurance

---
 index.bs | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/index.bs b/index.bs
index d7b004f..4365174 100644
--- a/index.bs
+++ b/index.bs
@@ -1246,6 +1246,16 @@ The {{ToolAnnotations}} dictionary provides optional metadata about a tool:
   :: If true, indicates that the tool is intended for debugging and developer tooling rather than end-user interactions.
 </dl>
 
+Note: A member that is not specified has the value false, and once the dictionary is converted a
+tool that leaves a member out cannot be told apart from one that sets it to false. A false
+{{ToolAnnotations/consequentialHint}} or {{ToolAnnotations/untrustedContentHint}} is therefore not
+an assurance from the site that the tool's effects are minor or that its output can be trusted. It
+can mean only that the site made no claim. The annotations are supplied by the site that registers
+the tool and are not verified by the [=user agent=] (see [[#misrepresentation-of-intent]]).
+[=Agents=] are encouraged to honor a hint that increases scrutiny, and not to rely on a hint that
+decreases it as the only reason to skip a user confirmation or a sanitization step that they would
+otherwise apply.
+
 <h4 id="tool-execute-callback-options">ToolExecuteCallbackOptions Dictionary</h4>
 
 The {{ToolExecuteCallbackOptions}} dictionary carries options passed to a tool's

From c2f903396efb74aefc6d885ee02a1dc9725e5a34 Mon Sep 17 00:00:00 2001
From: Kenneth Rohde Christiansen <kenneth.christiansen@gmail.com>
Date: Tue, 20 Oct 2026 12:22:48 +0200
Subject: [PATCH 2/2] Add an openWorldHint annotation

---
 index.bs | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/index.bs b/index.bs
index 4365174..bcbcee9 100644
--- a/index.bs
+++ b/index.bs
@@ -230,6 +230,9 @@ An <dfn>annotations</dfn> is a [=struct=] with the following [=struct/items=]:
   : <dfn>consequential hint</dfn>
   :: a [=boolean=], initially false.
 
+  : <dfn>open world hint</dfn>
+  :: a [=boolean=], initially true.
+
   : <dfn>debugging</dfn>
   :: a [=boolean=], initially false.
 </dl>
@@ -855,6 +858,9 @@ The <dfn method for=ModelContext>registerTool(<var>tool</var>, <var>options</var
       : [=annotations/consequential hint=]
       :: |tool|'s {{ModelContextTool/annotations}}'s {{ToolAnnotations/consequentialHint}}
 
+      : [=annotations/open world hint=]
+      :: |tool|'s {{ModelContextTool/annotations}}'s {{ToolAnnotations/openWorldHint}}
+
       : [=annotations/debugging=]
       :: |tool|'s {{ModelContextTool/annotations}}'s {{ToolAnnotations/debugging}}
 
@@ -982,7 +988,9 @@ The <dfn method for=ModelContext>getTools(<var>options</var>)</dfn> method steps
                {{ToolAnnotations/untrustedContentHint}} is |tool definition|'s [=tool
                definition/annotations=]'s [=annotations/untrusted content hint=],
                {{ToolAnnotations/consequentialHint}} is |tool definition|'s [=tool
-               definition/annotations=]'s [=annotations/consequential hint=], and
+               definition/annotations=]'s [=annotations/consequential hint=],
+               {{ToolAnnotations/openWorldHint}} is |tool definition|'s [=tool
+               definition/annotations=]'s [=annotations/open world hint=], and
                {{ToolAnnotations/debugging}} is |tool definition|'s [=tool
                definition/annotations=]'s [=annotations/debugging=].
 
@@ -1181,6 +1189,7 @@ dictionary ToolAnnotations {
   boolean readOnlyHint = false;
   boolean untrustedContentHint = false;
   boolean consequentialHint = false;
+  boolean openWorldHint = true;
   boolean debugging = false;
 };
 
@@ -1242,12 +1251,19 @@ The {{ToolAnnotations}} dictionary provides optional metadata about a tool:
   : <code><var ignore>annotations</var>["{{ToolAnnotations/consequentialHint}}"]</code>
   :: If true, indicates that executing the tool will result in consequential actions that are significant, real-world, or non-reversible, ex: booking a flight, transferring money.
 
+  : <code><var ignore>annotations</var>["{{ToolAnnotations/openWorldHint}}"]</code>
+  :: If true, indicates that the tool may send data to, or read data from, parties other than the
+     [=Document/origin=] of the page that registered it, for example through requests to other
+     origins. If false, indicates that the tool only uses the page and its own origin. Unlike the
+     other hints this one is true when it is not specified, so a tool that does not declare it is
+     treated as open to the world. The [=user agent=] does not enforce it.
+
   : <code><var ignore>annotations</var>["{{ToolAnnotations/debugging}}"]</code>
   :: If true, indicates that the tool is intended for debugging and developer tooling rather than end-user interactions.
 </dl>
 
-Note: A member that is not specified has the value false, and once the dictionary is converted a
-tool that leaves a member out cannot be told apart from one that sets it to false. A false
+Note: A member that is not specified has its default value, and once the dictionary is converted a
+tool that leaves a member out cannot be told apart from one that sets it to that value. A false
 {{ToolAnnotations/consequentialHint}} or {{ToolAnnotations/untrustedContentHint}} is therefore not
 an assurance from the site that the tool's effects are minor or that its output can be trusted. It
 can mean only that the site made no claim. The annotations are supplied by the site that registers