Couldn't that be solved with a simple bookmarklet permission model? The script would request the same pop-up features as a website?
With something like WebMCP you get elicitation and the ability to disable tools from the client.
It's also a contract for how LLM's interact with a website, they can do no more than the tools allow them to do. When you are running javascript on the page, the entire website is an attack surface.
Let's take gmail, for example. There is no way to protect your webpage from an agent running a script that sends an email by triggering the send email button. But with WebMCP, you can explicitly disable the "send_email" tool when the agent interacts with gmail.