| Test | chatgpt | claude | cursor | goose | mistral | alpic-playground |
|---|---|---|---|---|---|---|
| MUST | ||||||
| lifecycle/initialize-capabilities in-view · 2026-01-26 · L624 | PASS | PASS | PASS | PASS | PASS | PASS |
| lifecycle/tool-input in-view · 2026-01-26 · L1106 | PASSCaptured via the ontoolinput callback (registered before connect). TIMEOUT means the host never sent it for the launching tool. | PASSCaptured via the ontoolinput callback (registered before connect). TIMEOUT means the host never sent it for the launching tool. | PASSCaptured via the ontoolinput callback (registered before connect). TIMEOUT means the host never sent it for the launching tool. | PASSCaptured via the ontoolinput callback (registered before connect). TIMEOUT means the host never sent it for the launching tool. | PASSCaptured via the ontoolinput callback (registered before connect). TIMEOUT means the host never sent it for the launching tool. | PASSCaptured via the ontoolinput callback (registered before connect). TIMEOUT means the host never sent it for the launching tool. |
| lifecycle/tool-input-partial-stop in-view · 2026-01-26 · L1136 | PASSOnly catches a violation if the host actually streams partials; our launcher tool has no streamable args, so this usually passes vacuously (0 partials observed). | PASSOnly catches a violation if the host actually streams partials; our launcher tool has no streamable args, so this usually passes vacuously (0 partials observed). | PASSOnly catches a violation if the host actually streams partials; our launcher tool has no streamable args, so this usually passes vacuously (0 partials observed). | PASSOnly catches a violation if the host actually streams partials; our launcher tool has no streamable args, so this usually passes vacuously (0 partials observed). | PASSOnly catches a violation if the host actually streams partials; our launcher tool has no streamable args, so this usually passes vacuously (0 partials observed). | PASSOnly catches a violation if the host actually streams partials; our launcher tool has no streamable args, so this usually passes vacuously (0 partials observed). |
| lifecycle/tool-result in-view · 2026-01-26 · L1155 | PASSCaptured via ontoolresult. Some hosts may not replay tool-result for the tool that launched the view — TIMEOUT flags that. | PASSCaptured via ontoolresult. Some hosts may not replay tool-result for the tool that launched the view — TIMEOUT flags that. | PASSCaptured via ontoolresult. Some hosts may not replay tool-result for the tool that launched the view — TIMEOUT flags that. | PASSCaptured via ontoolresult. Some hosts may not replay tool-result for the tool that launched the view — TIMEOUT flags that. | PASSCaptured via ontoolresult. Some hosts may not replay tool-result for the tool that launched the view — TIMEOUT flags that. | PASSCaptured via ontoolresult. Some hosts may not replay tool-result for the tool that launched the view — TIMEOUT flags that. |
| tools/proxy-call in-view · 2026-01-26 · L487 | PASSThe server also sees this call directly, so it can be corroborated server-side. | PASSThe server also sees this call directly, so it can be corroborated server-side. | PASSThe server also sees this call directly, so it can be corroborated server-side. | PASSThe server also sees this call directly, so it can be corroborated server-side. | PASSThe server also sees this call directly, so it can be corroborated server-side. | PASSThe server also sees this call directly, so it can be corroborated server-side. |
| visibility/app-tool-call-guard in-view · 2026-01-26 · L401 | FAILhost must reject an app's tools/call for a tool lacking "app" visibility Covers the app→tool direction only. The complementary `visibility/app-tool-hidden` (tool absent from the *agent's* list) needs the agent vantage and isn't measurable here. | FAILhost must reject an app's tools/call for a tool lacking "app" visibility Covers the app→tool direction only. The complementary `visibility/app-tool-hidden` (tool absent from the *agent's* list) needs the agent vantage and isn't measurable here. | PASSCovers the app→tool direction only. The complementary `visibility/app-tool-hidden` (tool absent from the *agent's* list) needs the agent vantage and isn't measurable here. | FAILhost must reject an app's tools/call for a tool lacking "app" visibility Covers the app→tool direction only. The complementary `visibility/app-tool-hidden` (tool absent from the *agent's* list) needs the agent vantage and isn't measurable here. | PASSCovers the app→tool direction only. The complementary `visibility/app-tool-hidden` (tool absent from the *agent's* list) needs the agent vantage and isn't measurable here. | PASSCovers the app→tool direction only. The complementary `visibility/app-tool-hidden` (tool absent from the *agent's* list) needs the agent vantage and isn't measurable here. |
| display/return-resulting-mode in-view · 2026-01-26 · L787 | PASSRequests the current mode ('inline') to avoid a disruptive change, but a host may still re-render as a side effect. | PASSRequests the current mode ('inline') to avoid a disruptive change, but a host may still re-render as a side effect. | FAIL[
{
"code": "invalid_union",
"errors": [
[
{
"code": "invalid_value",
"values": [
"inline"
],
"path": [],
"message": "Invalid input: expected \"inline\""
}
],
[
{
"code": "invalid_value",
"values": [
"fullscreen"
],
"path": [],
"message": "Invalid input: expected \"fullscreen\""
}
],
[
{
"code": "invalid_value",
"values": [
"pip"
],
"path": [],
"message": "Invalid input: expected \"pip\""
}
]
],
"path": [
"mode"
],
"message": "Invalid input"
}
] Requests the current mode ('inline') to avoid a disruptive change, but a host may still re-render as a side effect. | PASSRequests the current mode ('inline') to avoid a disruptive change, but a host may still re-render as a side effect. | PASSRequests the current mode ('inline') to avoid a disruptive change, but a host may still re-render as a side effect. | PASSRequests the current mode ('inline') to avoid a disruptive change, but a host may still re-render as a side effect. |
| dimensions/listen-size-changed in-view · 2026-01-26 · L718 | PASSFlexible mode only (returns vacuously if the host pins a fixed height). Relies on autoResize reporting the taller content and the view's window.innerHeight reflecting the resize; the host may clamp to maxHeight. | PASSFlexible mode only (returns vacuously if the host pins a fixed height). Relies on autoResize reporting the taller content and the view's window.innerHeight reflecting the resize; the host may clamp to maxHeight. | PASSFlexible mode only (returns vacuously if the host pins a fixed height). Relies on autoResize reporting the taller content and the view's window.innerHeight reflecting the resize; the host may clamp to maxHeight. | PASSFlexible mode only (returns vacuously if the host pins a fixed height). Relies on autoResize reporting the taller content and the view's window.innerHeight reflecting the resize; the host may clamp to maxHeight. | PASSFlexible mode only (returns vacuously if the host pins a fixed height). Relies on autoResize reporting the taller content and the view's window.innerHeight reflecting the resize; the host may clamp to maxHeight. | PASSFlexible mode only (returns vacuously if the host pins a fixed height). Relies on autoResize reporting the taller content and the view's window.innerHeight reflecting the resize; the host may clamp to maxHeight. |
| security/sandbox-distinct-origin in-view · 2026-01-26 · L474 | PASSHost ≠ Sandbox. The View runs same-origin inside the Sandbox, so this checks window.top (the host), not window.parent (the sandbox). Opened top-level (no host), window.top === self and this FAILs — correct, it's not in a host. | PASSHost ≠ Sandbox. The View runs same-origin inside the Sandbox, so this checks window.top (the host), not window.parent (the sandbox). Opened top-level (no host), window.top === self and this FAILs — correct, it's not in a host. | PASSHost ≠ Sandbox. The View runs same-origin inside the Sandbox, so this checks window.top (the host), not window.parent (the sandbox). Opened top-level (no host), window.top === self and this FAILs — correct, it's not in a host. | PASSHost ≠ Sandbox. The View runs same-origin inside the Sandbox, so this checks window.top (the host), not window.parent (the sandbox). Opened top-level (no host), window.top === self and this FAILs — correct, it's not in a host. | PASSHost ≠ Sandbox. The View runs same-origin inside the Sandbox, so this checks window.top (the host), not window.parent (the sandbox). Opened top-level (no host), window.top === self and this FAILs — correct, it's not in a host. | FAILreading window.top.location (the host) must throw — host and sandbox must have different origins Host ≠ Sandbox. The View runs same-origin inside the Sandbox, so this checks window.top (the host), not window.parent (the sandbox). Opened top-level (no host), window.top === self and this FAILs — correct, it's not in a host. |
| security/sandbox-permissions in-view · 2026-01-26 · L475 | PASSInferred: scripts executing ⇒ allow-scripts; non-opaque window.origin ⇒ allow-same-origin. | PASSInferred: scripts executing ⇒ allow-scripts; non-opaque window.origin ⇒ allow-same-origin. | PASSInferred: scripts executing ⇒ allow-scripts; non-opaque window.origin ⇒ allow-same-origin. | PASSInferred: scripts executing ⇒ allow-scripts; non-opaque window.origin ⇒ allow-same-origin. | PASSInferred: scripts executing ⇒ allow-scripts; non-opaque window.origin ⇒ allow-same-origin. | PASSInferred: scripts executing ⇒ allow-scripts; non-opaque window.origin ⇒ allow-same-origin. |
| security/csp-construct-from-domains in-view · 2026-01-26 · L479 | PASSReads the applied CSP via a <meta> tag or the securitypolicyviolation event's originalPolicy. ⚠️ if the host delivers CSP only by HTTP header and no violation fires (or originalPolicy is redacted), it can't be read. | PASSReads the applied CSP via a <meta> tag or the securitypolicyviolation event's originalPolicy. ⚠️ if the host delivers CSP only by HTTP header and no violation fires (or originalPolicy is redacted), it can't be read. | PASSReads the applied CSP via a <meta> tag or the securitypolicyviolation event's originalPolicy. ⚠️ if the host delivers CSP only by HTTP header and no violation fires (or originalPolicy is redacted), it can't be read. | FAILcould not read the applied CSP (no <meta> tag and no securitypolicyviolation fired) Reads the applied CSP via a <meta> tag or the securitypolicyviolation event's originalPolicy. ⚠️ if the host delivers CSP only by HTTP header and no violation fires (or originalPolicy is redacted), it can't be read. | PASSReads the applied CSP via a <meta> tag or the securitypolicyviolation event's originalPolicy. ⚠️ if the host delivers CSP only by HTTP header and no violation fires (or originalPolicy is redacted), it can't be read. | PASSReads the applied CSP via a <meta> tag or the securitypolicyviolation event's originalPolicy. ⚠️ if the host delivers CSP only by HTTP header and no violation fires (or originalPolicy is redacted), it can't be read. |
| security/csp-allow-declared in-view · 2026-01-26 · L479 | PASSThe runner declares connectDomains: ["https://modelcontextprotocol.io/"]. ⚠️ a network failure also reads as "not allowed", so the origin must be reachable. | PASSThe runner declares connectDomains: ["https://modelcontextprotocol.io/"]. ⚠️ a network failure also reads as "not allowed", so the origin must be reachable. | PASSThe runner declares connectDomains: ["https://modelcontextprotocol.io/"]. ⚠️ a network failure also reads as "not allowed", so the origin must be reachable. | PASSThe runner declares connectDomains: ["https://modelcontextprotocol.io/"]. ⚠️ a network failure also reads as "not allowed", so the origin must be reachable. | PASSThe runner declares connectDomains: ["https://modelcontextprotocol.io/"]. ⚠️ a network failure also reads as "not allowed", so the origin must be reachable. | PASSThe runner declares connectDomains: ["https://modelcontextprotocol.io/"]. ⚠️ a network failure also reads as "not allowed", so the origin must be reachable. |
| security/iframe-sandboxed host · 2026-01-26 · L1698 | PASSOperator-read: the sandboxed View's content is cross-origin, but the <iframe> element (and its sandbox attribute) lives in the host document and is readable. Asserts the host uses at least one sandboxed iframe. | PASSOperator-read: the sandboxed View's content is cross-origin, but the <iframe> element (and its sandbox attribute) lives in the host document and is readable. Asserts the host uses at least one sandboxed iframe. | PASSOperator-read: the sandboxed View's content is cross-origin, but the <iframe> element (and its sandbox attribute) lives in the host document and is readable. Asserts the host uses at least one sandboxed iframe. | PASSOperator-read: the sandboxed View's content is cross-origin, but the <iframe> element (and its sandbox attribute) lives in the host document and is readable. Asserts the host uses at least one sandboxed iframe. | PASSOperator-read: the sandboxed View's content is cross-origin, but the <iframe> element (and its sandbox attribute) lives in the host document and is readable. Asserts the host uses at least one sandboxed iframe. | PASSOperator-read: the sandboxed View's content is cross-origin, but the <iframe> element (and its sandbox attribute) lives in the host document and is readable. Asserts the host uses at least one sandboxed iframe. |
| security/sandbox-proxy-required in-view · 2026-01-26 · L472 | PASSPaired with sandbox-distinct-origin (Host != Sandbox): window.parent (the sandbox) != window.top (the host) proves an intermediate proxy frame. Opened top-level, window.top === self and this FAILs — correct, it's not in a host. | PASSPaired with sandbox-distinct-origin (Host != Sandbox): window.parent (the sandbox) != window.top (the host) proves an intermediate proxy frame. Opened top-level, window.top === self and this FAILs — correct, it's not in a host. | PASSPaired with sandbox-distinct-origin (Host != Sandbox): window.parent (the sandbox) != window.top (the host) proves an intermediate proxy frame. Opened top-level, window.top === self and this FAILs — correct, it's not in a host. | PASSPaired with sandbox-distinct-origin (Host != Sandbox): window.parent (the sandbox) != window.top (the host) proves an intermediate proxy frame. Opened top-level, window.top === self and this FAILs — correct, it's not in a host. | PASSPaired with sandbox-distinct-origin (Host != Sandbox): window.parent (the sandbox) != window.top (the host) proves an intermediate proxy frame. Opened top-level, window.top === self and this FAILs — correct, it's not in a host. | PASSPaired with sandbox-distinct-origin (Host != Sandbox): window.parent (the sandbox) != window.top (the host) proves an intermediate proxy frame. Opened top-level, window.top === self and this FAILs — correct, it's not in a host. |
| MUST NOT | ||||||
| display/no-undeclared-mode in-view · 2026-01-26 · L786 | FAILhost must not switch the view to a mode it didn't declare (pip) We declare only inline/fullscreen in appCapabilities, then request the undeclared 'pip'. | PASSWe declare only inline/fullscreen in appCapabilities, then request the undeclared 'pip'. | PASSWe declare only inline/fullscreen in appCapabilities, then request the undeclared 'pip'. | PASSWe declare only inline/fullscreen in appCapabilities, then request the undeclared 'pip'. | PASSWe declare only inline/fullscreen in appCapabilities, then request the undeclared 'pip'. | PASSWe declare only inline/fullscreen in appCapabilities, then request the undeclared 'pip'. |
| security/csp-no-loosening in-view · 2026-01-26 · L286 | PASSBacked by csp-allow-declared as the positive control: the declared origin works, so blocking this one is genuinely the CSP, not a blanket fetch failure. | PASSBacked by csp-allow-declared as the positive control: the declared origin works, so blocking this one is genuinely the CSP, not a blanket fetch failure. | PASSBacked by csp-allow-declared as the positive control: the declared origin works, so blocking this one is genuinely the CSP, not a blanket fetch failure. | FAILthe host must not allow the undeclared origin https://example.com/ (no loosening beyond declared domains) Backed by csp-allow-declared as the positive control: the declared origin works, so blocking this one is genuinely the CSP, not a blanket fetch failure. | PASSBacked by csp-allow-declared as the positive control: the declared origin works, so blocking this one is genuinely the CSP, not a blanket fetch failure. | PASSBacked by csp-allow-declared as the positive control: the declared origin works, so blocking this one is genuinely the CSP, not a blanket fetch failure. |
| visibility/app-tool-hidden host · 2026-01-26 · L400 | PASS`conformance_probe` is app-only (visibility ["app"]) so it must not be in the model-facing tools/list. Uses the desktop-host tool-list affordance if available, else the agent's own (truthful) enumeration. | PASS`conformance_probe` is app-only (visibility ["app"]) so it must not be in the model-facing tools/list. Uses the desktop-host tool-list affordance if available, else the agent's own (truthful) enumeration. | FAILhost does not advertise ui/message `conformance_probe` is app-only (visibility ["app"]) so it must not be in the model-facing tools/list. Uses the desktop-host tool-list affordance if available, else the agent's own (truthful) enumeration. | FAILhost does not advertise ui/message `conformance_probe` is app-only (visibility ["app"]) so it must not be in the model-facing tools/list. Uses the desktop-host tool-list affordance if available, else the agent's own (truthful) enumeration. | FAILhidden tool name `conformance_probe` surfaced in the conversation `conformance_probe` is app-only (visibility ["app"]) so it must not be in the model-facing tools/list. Uses the desktop-host tool-list affordance if available, else the agent's own (truthful) enumeration. | PASS`conformance_probe` is app-only (visibility ["app"]) so it must not be in the model-facing tools/list. Uses the desktop-host tool-list affordance if available, else the agent's own (truthful) enumeration. |
| SHOULD | ||||||
| context/initialize-hostcontext in-view · 2026-01-26 · L533 | PASSSHOULD, not MUST — a host may legitimately omit hostContext, which would FAIL here. We assert presence; a richer version would only validate shape when present. | PASSSHOULD, not MUST — a host may legitimately omit hostContext, which would FAIL here. We assert presence; a richer version would only validate shape when present. | PASSSHOULD, not MUST — a host may legitimately omit hostContext, which would FAIL here. We assert presence; a richer version would only validate shape when present. | PASSSHOULD, not MUST — a host may legitimately omit hostContext, which would FAIL here. We assert presence; a richer version would only validate shape when present. | PASSSHOULD, not MUST — a host may legitimately omit hostContext, which would FAIL here. We assert presence; a richer version would only validate shape when present. | PASSSHOULD, not MUST — a host may legitimately omit hostContext, which would FAIL here. We assert presence; a richer version would only validate shape when present. |
| context/light-dark in-view · 2026-01-26 · L895 | FAILhost provides style variables but none use light-dark() SHOULD, and only observable when the host passes style variables. Non-color variables (radii, shadows) legitimately don't use light-dark(), so this is a signal, not a hard fail. | PASSSHOULD, and only observable when the host passes style variables. Non-color variables (radii, shadows) legitimately don't use light-dark(), so this is a signal, not a hard fail. | FAILhost provided no style variables to check for light-dark() SHOULD, and only observable when the host passes style variables. Non-color variables (radii, shadows) legitimately don't use light-dark(), so this is a signal, not a hard fail. | PASSSHOULD, and only observable when the host passes style variables. Non-color variables (radii, shadows) legitimately don't use light-dark(), so this is a signal, not a hard fail. | FAILhost provides style variables but none use light-dark() SHOULD, and only observable when the host passes style variables. Non-color variables (radii, shadows) legitimately don't use light-dark(), so this is a signal, not a hard fail. | PASSSHOULD, and only observable when the host passes style variables. Non-color variables (radii, shadows) legitimately don't use light-dark(), so this is a signal, not a hard fail. |
| display/unavailable-returns-current in-view · 2026-01-26 · L788 | FAILhost should return the current display mode for an unavailable request: expected "inline", got "pip" SHOULD — assumes the current mode is stable between reading hostContext and the request. | PASSSHOULD — assumes the current mode is stable between reading hostContext and the request. | FAILhost returned a malformed result with no valid mode for an unavailable request: [
{
"code": "invalid_union",
"errors": [
[
{
"code": "invalid_value",
"values": [
"inline"
],
"path": [],
"message": "Invalid input: expected \"inline\""
}
],
[
{
"code": "invalid_value",
"values": [
"fullscreen"
],
"path": [],
"message": "Invalid input: expected \"fullscreen\""
}
],
[
{
"code": "invalid_value",
"values": [
"pip"
],
"path": [],
"message": "Invalid input: expected \"pip\""
}
]
],
"path": [
"mode"
],
"message": "Invalid input"
}
] SHOULD — assumes the current mode is stable between reading hostContext and the request. | PASSSHOULD — assumes the current mode is stable between reading hostContext and the request. | PASSSHOULD — assumes the current mode is stable between reading hostContext and the request. | PASSSHOULD — assumes the current mode is stable between reading hostContext and the request. |
| capabilities/server-passthrough in-view · 2026-01-26 · L487 | FAILMCP error -32000: Internal Server Error Exercises resources/list passthrough (distinct from tools/proxy-call's tools/call). Gated on the host advertising serverResources. | PASSExercises resources/list passthrough (distinct from tools/proxy-call's tools/call). Gated on the host advertising serverResources. | FAILMCP error -32000: Unsupported method: resources/list Exercises resources/list passthrough (distinct from tools/proxy-call's tools/call). Gated on the host advertising serverResources. | FAILhost does not advertise serverResources — resource passthrough not supported Exercises resources/list passthrough (distinct from tools/proxy-call's tools/call). Gated on the host advertising serverResources. | PASSExercises resources/list passthrough (distinct from tools/proxy-call's tools/call). Gated on the host advertising serverResources. | PASSExercises resources/list passthrough (distinct from tools/proxy-call's tools/call). Gated on the host advertising serverResources. |
| links/open-external host · 2026-01-26 · L996 | PASSHost-vantage: the sandboxed view can't see the host open a tab, so the Runner triggers ui/open-link and verifies a tab opened (accepting a consent dialog if shown; some hosts open with none). | PASSHost-vantage: the sandboxed view can't see the host open a tab, so the Runner triggers ui/open-link and verifies a tab opened (accepting a consent dialog if shown; some hosts open with none). | SKIPhost does not support checkLinkOpen Host-vantage: the sandboxed view can't see the host open a tab, so the Runner triggers ui/open-link and verifies a tab opened (accepting a consent dialog if shown; some hosts open with none). | FAILhost did not open the link Host-vantage: the sandboxed view can't see the host open a tab, so the Runner triggers ui/open-link and verifies a tab opened (accepting a consent dialog if shown; some hosts open with none). | PASSHost-vantage: the sandboxed view can't see the host open a tab, so the Runner triggers ui/open-link and verifies a tab opened (accepting a consent dialog if shown; some hosts open with none). | PASSHost-vantage: the sandboxed view can't see the host open a tab, so the Runner triggers ui/open-link and verifies a tab opened (accepting a consent dialog if shown; some hosts open with none). |
| messages/add-to-conversation host · 2026-01-26 · L1033 | PASSHost-vantage: the view can't read the host's conversation, so the Runner confirms the marker appeared (some hosts draft into the composer — commitDraftedMessage sends it). | PASSHost-vantage: the view can't read the host's conversation, so the Runner confirms the marker appeared (some hosts draft into the composer — commitDraftedMessage sends it). | FAILhost does not advertise ui/message Host-vantage: the view can't read the host's conversation, so the Runner confirms the marker appeared (some hosts draft into the composer — commitDraftedMessage sends it). | FAILhost does not advertise ui/message Host-vantage: the view can't read the host's conversation, so the Runner confirms the marker appeared (some hosts draft into the composer — commitDraftedMessage sends it). | PASSHost-vantage: the view can't read the host's conversation, so the Runner confirms the marker appeared (some hosts draft into the composer — commitDraftedMessage sends it). | PASSHost-vantage: the view can't read the host's conversation, so the Runner confirms the marker appeared (some hosts draft into the composer — commitDraftedMessage sends it). |
| model-context/provide-future-turns host · 2026-01-26 · L1097 | PASSMulti-turn, host-vantage: seeds ui/update-model-context then asks the agent to recall it; confirms the host fed the context to the model on the following turn. | FAILthe model did not receive the seeded context on the next turn Multi-turn, host-vantage: seeds ui/update-model-context then asks the agent to recall it; confirms the host fed the context to the model on the following turn. | FAILhost does not advertise ui/update-model-context Multi-turn, host-vantage: seeds ui/update-model-context then asks the agent to recall it; confirms the host fed the context to the model on the following turn. | FAILhost does not advertise ui/update-model-context Multi-turn, host-vantage: seeds ui/update-model-context then asks the agent to recall it; confirms the host fed the context to the model on the following turn. | PASSMulti-turn, host-vantage: seeds ui/update-model-context then asks the agent to recall it; confirms the host fed the context to the model on the following turn. | PASSMulti-turn, host-vantage: seeds ui/update-model-context then asks the agent to recall it; confirms the host fed the context to the model on the following turn. |
| sampling/create-message host · draft · L534 | FAILhost does not advertise the sampling capability Draft. Capability-gated. The host has full discretion (model selection, rate limiting, user approval); the Runner triggers the call, may approve it, and confirms the reply. | FAILhost does not advertise the sampling capability Draft. Capability-gated. The host has full discretion (model selection, rate limiting, user approval); the Runner triggers the call, may approve it, and confirms the reply. | FAILhost does not advertise the sampling capability Draft. Capability-gated. The host has full discretion (model selection, rate limiting, user approval); the Runner triggers the call, may approve it, and confirms the reply. | FAILhost does not advertise the sampling capability Draft. Capability-gated. The host has full discretion (model selection, rate limiting, user approval); the Runner triggers the call, may approve it, and confirms the reply. | FAILhost does not advertise the sampling capability Draft. Capability-gated. The host has full discretion (model selection, rate limiting, user approval); the Runner triggers the call, may approve it, and confirms the reply. | FAILhost does not advertise the sampling capability Draft. Capability-gated. The host has full discretion (model selection, rate limiting, user approval); the Runner triggers the call, may approve it, and confirms the reply. |
| download-file/confirm host · draft · L1128 | FAILhost does not advertise the downloadFile capability Draft. Host-vantage: the download and its confirmation dialog occur outside the sandboxed iframe, so the Runner confirms. | PASSDraft. Host-vantage: the download and its confirmation dialog occur outside the sandboxed iframe, so the Runner confirms. | FAILhost does not advertise the downloadFile capability Draft. Host-vantage: the download and its confirmation dialog occur outside the sandboxed iframe, so the Runner confirms. | FAILhost does not advertise the downloadFile capability Draft. Host-vantage: the download and its confirmation dialog occur outside the sandboxed iframe, so the Runner confirms. | FAILhost does not advertise the downloadFile capability Draft. Host-vantage: the download and its confirmation dialog occur outside the sandboxed iframe, so the Runner confirms. | FAILhost does not advertise the downloadFile capability Draft. Host-vantage: the download and its confirmation dialog occur outside the sandboxed iframe, so the Runner confirms. |
| security/csp-audit-log host · 2026-01-26 · L287 | FAILno CSP configuration found in the host console (SHOULD log for security review) Operator-observable only: scans the browser console for a logged CSP; a host that logs server-side (not the console) reads as a fail here. | PASSOperator-observable only: scans the browser console for a logged CSP; a host that logs server-side (not the console) reads as a fail here. | FAILno CSP configuration found in the host console (SHOULD log for security review) Operator-observable only: scans the browser console for a logged CSP; a host that logs server-side (not the console) reads as a fail here. | FAILno CSP configuration found in the host console (SHOULD log for security review) Operator-observable only: scans the browser console for a logged CSP; a host that logs server-side (not the console) reads as a fail here. | FAILno CSP configuration found in the host console (SHOULD log for security review) Operator-observable only: scans the browser console for a logged CSP; a host that logs server-side (not the console) reads as a fail here. | PASSOperator-observable only: scans the browser console for a logged CSP; a host that logs server-side (not the console) reads as a fail here. |
| model-context/last-wins host · 2026-01-26 · L1101 | PASSSends two updates before the next user message; the reply should carry the fresh code, not the stale one. Weak if the agent doesn't echo the code verbatim. | FAILthe agent did not receive the last model-context update Sends two updates before the next user message; the reply should carry the fresh code, not the stale one. Weak if the agent doesn't echo the code verbatim. | FAILhost does not advertise ui/update-model-context Sends two updates before the next user message; the reply should carry the fresh code, not the stale one. Weak if the agent doesn't echo the code verbatim. | FAILhost does not advertise ui/update-model-context Sends two updates before the next user message; the reply should carry the fresh code, not the stale one. Weak if the agent doesn't echo the code verbatim. | PASSSends two updates before the next user message; the reply should carry the fresh code, not the stale one. Weak if the agent doesn't echo the code verbatim. | PASSSends two updates before the next user message; the reply should carry the fresh code, not the stale one. Weak if the agent doesn't echo the code verbatim. |
| MAY | ||||||
| context/theme-variables in-view · 2026-01-26 · L793 | PASSOptional (MAY). Signal only — inspect the exact values in the Inspector panel. | PASSOptional (MAY). Signal only — inspect the exact values in the Inspector panel. | FAILhost provided no style variables Optional (MAY). Signal only — inspect the exact values in the Inspector panel. | PASSOptional (MAY). Signal only — inspect the exact values in the Inspector panel. | PASSOptional (MAY). Signal only — inspect the exact values in the Inspector panel. | PASSOptional (MAY). Signal only — inspect the exact values in the Inspector panel. |
| context/theme-fonts in-view · 2026-01-26 · L922 | FAILhost provided no custom fonts Optional (MAY). Signal only — inspect the font CSS in the Inspector panel. | PASSOptional (MAY). Signal only — inspect the font CSS in the Inspector panel. | FAILhost provided no custom fonts Optional (MAY). Signal only — inspect the font CSS in the Inspector panel. | PASSOptional (MAY). Signal only — inspect the font CSS in the Inspector panel. | FAILhost provided no custom fonts Optional (MAY). Signal only — inspect the font CSS in the Inspector panel. | PASSOptional (MAY). Signal only — inspect the font CSS in the Inspector panel. |
| context/context-changed in-view · 2026-01-26 · L1229 | PASSThe Runner toggles the host theme and the view resolves on the hostcontextchanged notification. SKIP if the host doesn't emit it (e.g. theme pinned, not following the OS). | PASSThe Runner toggles the host theme and the view resolves on the hostcontextchanged notification. SKIP if the host doesn't emit it (e.g. theme pinned, not following the OS). | SKIPhost did not emit context-changed (may be pinned, not on System) The Runner toggles the host theme and the view resolves on the hostcontextchanged notification. SKIP if the host doesn't emit it (e.g. theme pinned, not following the OS). | PASSThe Runner toggles the host theme and the view resolves on the hostcontextchanged notification. SKIP if the host doesn't emit it (e.g. theme pinned, not following the OS). | PASSThe Runner toggles the host theme and the view resolves on the hostcontextchanged notification. SKIP if the host doesn't emit it (e.g. theme pinned, not following the OS). | PASSThe Runner toggles the host theme and the view resolves on the hostcontextchanged notification. SKIP if the host doesn't emit it (e.g. theme pinned, not following the OS). |
| capabilities/content-modalities in-view · draft · L663 | PASSDraft (specification/draft). Signal only — reports the SupportedContentBlockModalities the host advertises. | PASSDraft (specification/draft). Signal only — reports the SupportedContentBlockModalities the host advertises. | FAILhost declares no content-block modalities (message: not declared · updateModelContext: not declared) Draft (specification/draft). Signal only — reports the SupportedContentBlockModalities the host advertises. | FAILhost declares no content-block modalities (message: not declared · updateModelContext: not declared) Draft (specification/draft). Signal only — reports the SupportedContentBlockModalities the host advertises. | PASSDraft (specification/draft). Signal only — reports the SupportedContentBlockModalities the host advertises. | PASSDraft (specification/draft). Signal only — reports the SupportedContentBlockModalities the host advertises. |
| app-tools/call in-view · draft · L1243 | FAILthe agent did not call the app-registered tool conformance_ping Draft (App-Provided Tools). Requires the host to expose app-registered tools to the agent; the Runner asks the agent to call it and the harness detects the callback. | FAILthe agent did not call the app-registered tool conformance_ping Draft (App-Provided Tools). Requires the host to expose app-registered tools to the agent; the Runner asks the agent to call it and the harness detects the callback. | FAILthe agent did not call the app-registered tool conformance_ping Draft (App-Provided Tools). Requires the host to expose app-registered tools to the agent; the Runner asks the agent to call it and the harness detects the callback. | FAILthe agent did not call the app-registered tool conformance_ping Draft (App-Provided Tools). Requires the host to expose app-registered tools to the agent; the Runner asks the agent to call it and the harness detects the callback. | FAILthe agent did not call the app-registered tool conformance_ping Draft (App-Provided Tools). Requires the host to expose app-registered tools to the agent; the Runner asks the agent to call it and the harness detects the callback. | PASSDraft (App-Provided Tools). Requires the host to expose app-registered tools to the agent; the Runner asks the agent to call it and the harness detects the callback. |
| Test | Clause | Vantage | Spec |
|---|---|---|---|
| security/sandbox-proxy-ready | MUST | host | 2026-01-26 · L476 |
| security/sandbox-resource-ready | MUST | host | 2026-01-26 · L477 |
| security/sandbox-csp-enforced | MUST | host | 2026-01-26 · L478 |
| security/sandbox-message-forwarding | MUST | host | 2026-01-26 · L485 |
| security/csp-default-deny | MUST | in-view | 2026-01-26 · L483 |
| lifecycle/tool-cancelled | MUST | in-view | 2026-01-26 · L1169 |
| lifecycle/teardown-notify | MUST | in-view | 2026-01-26 · L1171 |
| resources/read-referenced | MUST | server | 2026-01-26 · L391 |
| resources/meta-both-locations | MUST | in-view | draft · L270 |
| resources/meta-precedence | MUST | in-view | draft · L270 |
| capabilities/mimetypes-required | REQUIRED | server | 2026-01-26 · L1522 |
| security/external-domain-warning | SHOULD | host | 2026-01-26 · L1757 |
| lifecycle/teardown-await | SHOULD | in-view | 2026-01-26 · L1202 |
| download-file/sanitize | SHOULD | host | draft · L1131 |
| sampling/host-discretion | SHOULD | host | draft · L534 |
| security/sandbox-no-self-requests | SHOULD NOT | host | 2026-01-26 · L486 |
| security/permissions-allow-attr | MAY | host | 2026-01-26 · L484 |
| security/global-allowlist | MAY | host | 2026-01-26 · L1758 |
| resources/prefetch | MAY | server | 2026-01-26 · L392 |
| display/decline-undeclared | MAY | in-view | 2026-01-26 · L789 |
| model-context/overwrite-defer-dedupe-display | MAY | host | 2026-01-26 · L1098 |
| download-file/reject | MAY | host | draft · L1130 |
| app-tools/list | MAY | in-view | draft · L1286 |