feat(webmcp): support consequential tool annotations

[antonvishal]

why

WebMCP added consequentialHint for tools that may perform high-stakes actions. Stagehand now exposes this signal so applications and agent adapters can request user approval before invoking those tools.

Reference: https://developer.chrome.com/docs/ai/webmcp/imperative-api#tool_annotations_optional, https://chromedevtools.github.io/devtools-protocol/tot/WebMCP/

what changed

• Added consequential support across the extension, protocol, and TypeScript, Python, and Go SDKs.
• Updated WebMCP documentation with approval guidance.
• Added protocol, adapter, SDK, and wire-casing coverage.

Note on minimumReleaseAgeExclude: devtools-protocol@0.0.1694333 was published earlier today and is temporarily listed there to satisfy pnpm’s policy. It can be removed once the package passes the release-age cutoff.

test plan

All tests are passing:

• Protocol: 326 tests
• Extension: 355 tests passed, 10 existing todos
• TypeScript SDK: 278 tests
• Python SDK: 179 tests
• Go SDK package tests
• Documentation: 27 tests
• TypeScript typecheck, lint, formatting, generated Python freshness, and diff checks

---

Summary by cubic

Adds support for WebMCP's consequential tool annotation across the protocol, extension, and all SDKs. This exposes the consequentialHint signal so applications can request user approval before invoking high-stakes tools.

• Adds the consequential field to the tool annotation schema and all SDKs (TypeScript, Python, Go).
• Documents the new annotation and warns that Stagehand does not prompt for confirmation; callers must enforce approval.
• Updates devtools-protocol to 0.0.1694333 and adds it to minimumReleaseAgeExclude temporarily to satisfy pnpm's supply-chain policy.

^{Written for commit 19d3970. Summary will update on new commits.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 19d3970

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 19 packages

Name	Type
@browserbasehq/stagehand-extension	Patch
@browserbasehq/stagehand-go	Patch
@browserbasehq/stagehand	Patch
@browserbasehq/stagehand-python	Patch
@browserbasehq/stagehand-integrations	Patch
@browserbasehq/stagehand-integrations-example-eve-facade	Patch
@browserbasehq/stagehand-integrations-example-pi-facade	Patch
@browserbasehq/stagehand-integrations-claude-agent-sdk	Patch
@browserbasehq/stagehand-integrations-example-claude-code-facade	Patch
@browserbasehq/stagehand-integrations-codex-sdk	Patch
@browserbasehq/stagehand-integrations-example-codex-facade	Patch
@browserbasehq/stagehand-integrations-cursor-sdk	Patch
@browserbasehq/stagehand-integrations-deepagents-sdk	Patch
@browserbasehq/stagehand-integrations-eve-sdk	Patch
@browserbasehq/stagehand-integrations-fx-sdk	Patch
@browserbasehq/stagehand-integrations-mastra-sdk	Patch
@browserbasehq/stagehand-integrations-example-mastra-facade	Patch
@browserbasehq/stagehand-integrations-pi-sdk	Patch
@browserbasehq/stagehand-integrations-example-vercel-ai-facade	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

This PR is from an external contributor and must be approved by a stagehand team member with write access before CI can run.
Approving the latest commit mirrors it into an internal PR owned by the approver.
If new commits are pushed later, the internal PR stays open but is marked stale until someone approves the latest external commit and refreshes it.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​devtools-protocol@​0.0.1657692 ⏵ 0.0.1694333	+1			+1

View full report