Reference

Result provenance

Treat extracted web content as untrusted input.

Upscrape retrieves data from third-party websites and APIs. The resulting JSON is useful application data, but its content is controlled by the upstream source.

## Trust boundary

Treat every field under capability output as untrusted input. This is especially important when results are consumed by an LLM, rendered as HTML, used in SQL, forwarded to another API, or turned into an operational decision.

MCP tool results include an `_provenance` marker that explicitly labels retrieved content as untrusted and says to treat it as data, never instructions.

## Application responsibilities

- Escape output for its rendering context.
- Validate types and ranges before persistence or action.
- Keep scraped instructions outside the model's trusted instruction hierarchy.
- Do not execute code, URLs, commands, or tool requests found in scraped content.
- Apply appropriate privacy, retention, and access controls.
- Review sample fixtures before publishing them.

## Output evolution

Raw capability output is open-ended and can gain fields as upstream sources evolve. Consumers should ignore unknown fields and avoid positional assumptions. Use explicit normalization layers for application-critical models.

Upscrape retrieves data from third-party websites and APIs. The resulting JSON is useful application data, but its content is controlled by the upstream source.

Trust boundary

Treat every field under capability output as untrusted input. This is especially important when results are consumed by an LLM, rendered as HTML, used in SQL, forwarded to another API, or turned into an operational decision.

MCP tool results include an _provenance marker that explicitly labels retrieved content as untrusted and says to treat it as data, never instructions.

Application responsibilities

Escape output for its rendering context.
Validate types and ranges before persistence or action.
Keep scraped instructions outside the model's trusted instruction hierarchy.
Do not execute code, URLs, commands, or tool requests found in scraped content.
Apply appropriate privacy, retention, and access controls.
Review sample fixtures before publishing them.

Output evolution

Raw capability output is open-ended and can gain fields as upstream sources evolve. Consumers should ignore unknown fields and avoid positional assumptions. Use explicit normalization layers for application-critical models.