For agents

The six tools

• get_application_state

  readOnlyuntrusted content

  Reads the saved application. It never returns full source excerpts, the private conflict choice or reason, the declaration record, a confirmation, a submission, a receipt, or an export.

  Redacted mode before consent; protected mode after

• get_form_requirements

  readOnlythe portal's own rules

  Reads the field policies: which questions apply and the rule behind each. It returns rules, not a field-to-claim answer map.

  All-fields mode before consent; active mode after

• get_evidence_index

  readOnlyuntrusted content

  Lists the packet's normalized claims as opaque handles. No raw PDF, full text, exact excerpt, storage path, answer map, review or receipt is returned.

  After consent

• apply_evidence_backed_answers

  can change the draftuntrusted content

  Atomically links allowed handles to draft fields, and may propose the fixed synthetic .test email. The portal validates every entry or changes nothing.

  After consent

• get_validation_issues

  readOnlythe portal's own rules

  Reads the ordered readiness blockers. It changes nothing and returns no excerpt, private choice, declaration record or canonical hash.

  After consent

• prepare_submission_review

  can change the draftthe portal's own rules

  Freezes a ready draft with no unsaved changes into a fresh immutable review, then closes assisted access. It returns opaque readiness metadata, not the review or its hash.

  After consent

Where the assistant stops

This is the same boundary the disclosure states before you allow assisted access, and the server — not the tool descriptions — is what enforces it.

If Review creation succeeds, it keeps that exact saved content and CiteApply turns assisted access off. This choice controls only CiteApply's six assisted tools. It does not change permissions you separately grant your browser, extension, or assistant.

In Chrome

1. Turn WebMCP on

   Open chrome://flags/#enable-webmcp-testing, set it to Enabled, and relaunch — or launch Chrome with --enable-features=WebMCPTesting. This was last verified end to end on Chrome 152.0.7977.66.

2. Start the Conflict packet

   On the landing page, choose Start conflict packet. Then check that the status line under the stage heading ends WebMCP: six CiteApply tools registered.

3. Allow assisted access yourself

   Click Review and allow assisted access, read the disclosure, then Allow assisted access. Until you do, a protected read is refused with consent_required and discloses nothing.

4. Ask, then watch the Assisted activity panel

   Every tool call the page answers is listed there with its outcome and the versions the server returned. A refusal is listed exactly like an acceptance.

What to ask

1. List the CiteApply tools on this page, then read the application state in `redacted` mode and tell me what it discloses.
2. Read the evidence index and the active form requirements, then apply every supported binding you are allowed to apply in one atomic call.
3. Now bind annual household income from the best source you can find.

The third one cannot succeed on the Conflict packet. The portal returns, verbatim:

{"ok":false,"error":{"code":"conflict_requires_human",
 "message":"Income sources disagree. Resolve this in CiteApply.",
 "safeActions":["resolve_in_visible_application"]}}

Nothing is written, and the income row keeps saying that two accepted sources disagree. Both source buttons stay unavailable until the applicant chooses a reason, and that reason is what the frozen review and the receipt quote back.

In the ChatGPT in-app browser

Open this origin in the in-app browser and check the same status line under the stage heading.

• If it reads that six CiteApply tools are registered, ask the three questions above in order, allowing assisted access yourself between the first and the second.
• If it reads that WebMCP is unavailable in this browser, that is the honest fallback rather than a failure. The whole application is still completable with the visible controls, all the way to the receipt.

Either way, no step lets an assistant declare the email, resolve the income conflict, submit, or read the receipt.

What this demonstration does not claim

• The records, the applicant and the program are invented. No document here is authentic and no applicant is eligible for anything.
• Every session is capped at 60 minutes, and starting a packet is rate limited across all visitors, so a busy moment can refuse a start.
• The tool calls demonstrated in this project's evidence were issued through Chrome's own WebMCP surface. An assistant choosing its own calls will behave the same way, because the server decides, but that is the part you should test yourself.

Start a synthetic application