On this page
Permissions remain authoritative
Agent Actions adds an interface to existing resources. It does not create another identity, membership, or storage system.
| Caller | Read actions | Mutations |
|---|---|---|
| Anonymous | Only accessible public resources | Denied |
| Viewer | Existing readable resources | Denied |
| Editor | Existing readable resources | Allowed when the operation and action are enabled |
| Owner / admin | Existing readable resources | Allowed when the operation and action are enabled |
Private, invite-only, password-protected, disabled, and unpublished sites retain their access boundaries. Remote access to a protected site requires a current member; a site password alone is not an OAuth identity. A blocked account or inactive membership cannot gain access through an action.
Every execution resolves the action and source on the server. Client-provided site IDs, roles, access modes, and source IDs cannot change execution authority. Browser calls require the exact origin for mutations. Remote tokens require an exact app audience, current account state, valid client, and appropriate scopes.
Limits and untrusted content
Tool names are limited to 64 characters, titles to 120, descriptions to 1,000, schemas to 16 KiB, inputs to 32 KiB, and results to 256 KiB. Each app can configure up to 100 actions. Existing Table and Function quotas apply alongside an action request rate limit.
Descriptions can contain owner-authored text and outputs can contain user-generated or external content. Neither is a trusted instruction source. Clients should treat them as data and review proposed actions, especially destructive or consequential operations. MiniUp marks WebMCP outputs untrusted and maps its internal risk classifications to each protocol’s annotations.
The registry stores no credentials, Table write keys, Function API keys, or Function Secrets. Manifests contain only tool definitions. Arbitrary input and output bodies are not stored in activity history. History records action name, source kind, protocol, identity mode, status, duration, timestamp, and safe error code.
Author Functions remain responsible for returning only appropriate application data and enforcing any finer-grained business rules. An action wrapper cannot safely identify every secret an author intentionally returns as data.