The No-Op Protocol tells unsupported or uncertain agents to stop safely. It is a required compatibility behavior, not a failure of usefulness.
Use no-op when
- The client cannot prove the capability level required by the action.
- The only available path is JavaScript-only, auth-only, POST-only, MCP-only, A2A-only, or tool-only and no lower-capability fallback is listed.
- The request would put secrets, private identifiers, regulated data, payment data, or private messages in a URL.
- The action could publish, delete, pay, change accounts, write repositories, promote memory, or affect a regulated context without explicit review.
- The agent would need to retry repeatedly to guess the next step.
No-op response
{ "code": "human_review_required", "url": "https://example.org/review/agent-handoff" }[]Field order follows the keyed JSON example, the published schema order, and the public field registry.
Required behavior
Open or cite the returned public URL, explain the missing capability or consent, and stop. Do not synthesize credentials, invent hidden URLs, retry loops, private browser steps, or writable actions.