Document WebMCP control telemetry and capture sensitivity

[rgarcia]

Summary

• Document metadata-only WebMCP discovery and the optional fields on invocation api_call events.
• Explain HTTP versus tool status, awaiting_submission, outcome_unknown, and nested Playwright capture without double-counting invocations.
• Document the 8 KiB string cap, MCP compact/raw behavior, omitted outputs and the sensitivity of invocation arguments and source URLs.

Validation

• Compiled the changed MDX with @mdx-js/mdx and remark-gfm.
• git diff --check passed.
• Mintlify site preview not run.

Rollout

Publish alongside the browser-image telemetry enhancement; the guide notes that invocation details depend on image support.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Sep 15, 2026, 7:17 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Very Low risk. Prior approval stands — risk did not increase on this update.

Re-evaluation (synchronize)

This PR was previously approved on 2f141c0. The new commit (d610656) only reformats existing WebMCP outcome guidance from one paragraph into a short heading plus five bullets. Same facts, same page, no new behavior described beyond what was already documented.

What changed (full PR)

• Single file: browsers/telemetry/categories.mdx (+33 / −5)
• Adds a WebMCP discovery/invocation section under the existing control category
• Extends the data-sensitivity table and HIPAA/GDPR warning to mention WebMCP invocation input and source URLs

Why this remains Very Low

• Documentation-only MDX on a Mintlify docs site; no application code, APIs, config, workflows, or infrastructure
• No production logic, auth, billing, or telemetry implementation changes — this describes capture behavior, it does not change it
• Isolated blast radius (one existing guide page)
• No CODEOWNERS file in the repo, so no codeowner review gate applies
• Not a model-instruction / prompt change

No approval action on this run: an approval from this automation is already in effect, and risk did not increase.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Very Low risk. Prior approval stands — risk did not increase on this update.

Re-evaluation (synchronize)

This PR was previously approved on 2f141c0. The latest commit (e330384) is a merge of origin/main into hypeship/webmcp-control-telemetry. Three-dot diff vs main is still a single documentation file. browsers/telemetry/categories.mdx is unchanged relative to the prior PR head (d610656).

What changed (full PR vs main)

• Single file: browsers/telemetry/categories.mdx (+33 / −5)
• Adds a WebMCP discovery/invocation section under the existing control category
• Extends the data-sensitivity table and HIPAA/GDPR warning to mention WebMCP invocation input and source URLs

Why this remains Very Low

• Documentation-only MDX on a Mintlify docs site; no application code, APIs, config, workflows, or infrastructure
• No production logic, auth, billing, or telemetry implementation changes — this describes capture behavior, it does not change it
• Isolated blast radius (one existing guide page)
• No CODEOWNERS file in the repo, so no codeowner review gate applies
• Not a model-instruction / prompt change

No approval action on this run: an approval from this automation is already in effect, and risk did not increase.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e330384. Configure here.}

[cursor]

Risk assessment: Very Low

Verdict: Very Low risk. Prior approval stands — risk did not increase on this update.

Re-evaluation (synchronize)

This PR was previously approved on 2f141c0. The latest unique change (0dcd6ca) only reformats existing WebMCP capture-limit guidance from one paragraph into a short heading plus four bullets. Same facts, same page. The other new commits are merges of origin/main into hypeship/webmcp-control-telemetry.

Three-dot diff vs main is still a single documentation file.

What changed (full PR vs main)

• Single file: browsers/telemetry/categories.mdx (+38 / −5)
• Adds a WebMCP discovery/invocation section under the existing control category
• Documents invocation fields, HTTP vs tool status, capture limits (8 KiB cap, omitted output, compact/raw view), and nested Playwright events
• Extends the data-sensitivity table and HIPAA/GDPR warning to mention WebMCP invocation input and source URLs

Why this remains Very Low

• Documentation-only MDX on a Mintlify docs site; no application code, APIs, config, workflows, or infrastructure
• No production logic, auth, billing, or telemetry implementation changes — this describes capture behavior, it does not change it
• Isolated blast radius (one existing guide page)
• No CODEOWNERS file in the repo, so no codeowner review gate applies
• Not a model-instruction / prompt change

No approval action on this run: an approval from this automation is already in effect, and risk did not increase.

  

_{Sent by Cursor Automation: Assign PR reviewers}