Opens in a new tabSkip to content
Agent LighthouseAgent Lighthouse

    Searches the text of every published page. The evidence sources themselves are not in this index — search all of them on the trusted sources page.

    GitHub ↗
    Browse checks and page contents
    operability-safety/first-contact-consent-gate-operability

    First-contact consent gate: cost to get past it

    What it checks

    Evaluates the cold-session interstitial an agent meets before any task work. Does primary content exist in the DOM behind the consent layer? Do the accept and reject controls have accessible names, and do they live in the main document rather than a cross-origin iframe? And does the layer trap the agent, through inert or aria-hidden on main content?

    Why it matters

    Plausible-convention claim: an agent arriving with no cookies must spend its first actions dismissing a consent layer before any task step. Three properties determine whether it can. (1) The layer may be rendered inside a cross-origin third-party iframe. DOM-text extractors that read only the top document then return the underlying page text, while the screenshot shows a blocker. The agent’s two modalities disagree, and it acts on stale content. (2) If the accept/reject controls are unroled or unnamed divs, they are unaddressable in the snapshot for the same reason as the Ghost-Clickable check. (3) Main content may be set inert or aria-hidden while the layer is open.

    Every subsequent snapshot is then empty until the layer is dismissed. axe’s own guidance notes that aria-hidden removes the element and all children from the accessibility API. WebVoyager names pop-up windows among the things real sites throw at agents. Test: load with a clean profile and diff the snapshot against a post-consent load.

    Evidence

    • MCP Specification 2026-07-28 — Streamable HTTP Transport — Model Context Protocol (Anthropic / MCP Working Groups) (spec, URL verified 2026-08-20)
    • Revision 2026-07-28 removed the GET stream endpoint and protocol-level sessions (Mcp-Session-Id, Last-Event-ID). Server MUST expose one POST endpoint. Server MUST validate Origin; if Origin is present and invalid it MUST return 403 Forbidden. Every POST MUST carry MCP-Protocol-Version, Mcp-Method, and (for tools/call, resources/read, prompts/get) Mcp-Name headers; these are ‘REQUIRED for compliance’. Header value MUST match the _meta body value or server MUST return 400 + JSON-RPC code -32020 HeaderMismatch. Unknown protocol version -> 400 + UnsupportedProtocolVersionError. Unknown method -> 404 + -32601. x-mcp-header constraints defined; clients MUST reject (exclude from tools/list) tools that violate them. Servers SHOULD send X-Accel-Buffering: no on SSE. GET/DELETE to endpoint SHOULD now return 405.
    • MCP Security Best Practices (2026-07-28) — Model Context Protocol (spec, URL verified 2026-08-20)
    • Token passthrough: ‘MCP servers MUST NOT accept any tokens that were not explicitly issued for the MCP server.’ Scope minimization: ‘Common Mistakes’ list names publishing all possible scopes in scopes_supported and using wildcard/omnibus scopes (*, all, full-access). State handle hijacking replaces session hijacking now that MCP is stateless: servers MUST NOT treat possession of a state handle as authentication; SHOULD use non-deterministic handles bound server-side to the authenticated user. SSRF section: clients SHOULD require HTTPS for all OAuth-related URLs and block private/link-local ranges (169.254.0.0/16 etc.).
    • Playwright MCP server — Microsoft (repo, URL verified 2026-08-20)
    • Default mode is ‘Playwright’s accessibility tree, not pixel-based input’; browser_snapshot returns interactive elements with roles and accessible names, and every action tool takes a ‘target’ = ‘exact target element reference from the page snapshot’. Coordinate clicking exists only behind the optional –caps=vision flag. Therefore an element absent from the a11y snapshot is literally unaddressable by the default toolchain.
    • Playwright: Auto-waiting / Actionability checks — Microsoft (vendor-doc, URL verified 2026-08-20)
    • Before click/check/fill/selectOption, Playwright enforces five checks: Visible (non-empty bounding box, not visibility:hidden), Stable (same bounding box over 2 animation frames), Receives Events (element is the hit target at the action point — overlays cause failure), Enabled (not [disabled]/aria-disabled), Editable (not readonly/aria-readonly). Fill requires visible+enabled+editable. This is the exact gate every Playwright-based agent (Playwright-MCP, browser-use, most CUA harnesses) passes through, so each check is a directly testable site-side failure cause.

    How it scores

    Tier per evidence policy: informative (weight 0) — grade C does not meet the A/B bar required for scored audits.

    Example failure

    A news site loads a Sourcepoint dialog in a cross-origin iframe and sets aria-hidden="true" on <main>. An agent reading page text via DOM extraction gets the article, because the text is in the DOM. But its accessibility snapshot is empty except for an unnamed iframe, so it cannot find any clickable element. Asked to click ‘Reject all’, it reports that no such control exists on the page.

    Sources