@@ -315,9 +315,11 @@ Legend for the **Enabled by default** column:
 All tools include metadata annotations to help MCP clients and LLMs understand tool behavior:
 
 - **`title`**: Short display name for the tool (e.g., "Search Actors", "Call Actor", "apify/rag-web-browser")
-- **`readOnlyHint`**: `true` for tools that only read data without modifying state (e.g., `get-dataset`, `fetch-actor-details`). Actor tools get it only for Apify-maintained Actors with limited permissions and no secret, writable storage, MCP connector, or code input (e.g., `apify--web-fetch`); other Actor tools are marked destructive.
+- **`readOnlyHint`**: `true` for tools that only read data without modifying state (e.g., `get-dataset`, `fetch-actor-details`). Actor tools get it only for Apify-maintained Actors with limited permissions and no accepted secret, writable storage, MCP connector, or code input (e.g., `apify--web-fetch`). Direct tools can restrict the original Actor inputs: `apify--website-content-crawler` excludes and rejects `pageFunction` and `initialCookies`, so it is read-only. Other Actor tools are marked destructive.
 - **`openWorldHint`**: `true` for tools that access external resources outside the Apify platform (e.g., `call-actor` executes external Actors). Tools that interact only with the Apify platform (like `search-actors` or `fetch-apify-docs`) do not have this hint.
 
+The direct `apify--website-content-crawler` tool defaults `respectRobotsTxtFile` to `true`; an explicit `false` is preserved. These restrictions and defaults apply only to the direct tool. `call-actor`, `call-actor-widget`, and `fetch-actor-details` retain the original Actor input contract.
+
 ### Tools configuration
 
 The `tools` configuration parameter is used to specify loaded tools – either categories or specific tools directly, and Apify Actors. For example, `tools=storage,runs` loads two categories; `tools=call-actor` loads just one tool.
 
@@ -44,7 +44,7 @@ their base tool.
 | Tool | readOnlyHint | destructiveHint | openWorldHint | Rationale |
 |---|---|---|---|---|
 | `call-actor` (both modes) | false | true | true | Runs Actors that can modify external state |
-| Dynamic Actor tools, read-only Apify-maintained Actors | true | false | true | Limited permissions, no secret, writable storage, MCP connector, or code input (`isReadOnlyActor`) |
+| Dynamic Actor tools, read-only Apify-maintained Actors | true | false | true | Limited permissions, no accepted secret, writable storage, MCP connector, or code input (`isReadOnlyActor`); WCC's direct contract excludes and rejects `pageFunction` and `initialCookies` |
 | Other dynamic Actor tools | false | true | true | Same as call-actor |
 | `abort-actor-run` | false | true | false | Irreversible abort within Apify platform |
 | `search-actors` | true | false | false | Searches Apify Store (read-only) |
 
@@ -14,6 +14,11 @@ import { prepareToolCallContext } from '../payments/helpers.js';
 import type { PaymentMeta, PaymentProvider, RequestHeaders } from '../payments/types.js';
 import { decodeDotPropertyNames } from '../tools/actor_input_schema.js';
 import { legacyToolNameToNew } from '../tools/actor_tool_naming.js';
+import {
+    buildDeniedInputsNote,
+    getDeniedDirectActorInputs,
+    getDirectActorPolicy,
+} from '../tools/actors/actor_tool_contract.js';
 import { checkPaymentProviderStandbyConflict } from '../tools/actors/call_actor.js';
 import { withReportProblemNudge } from '../tools/dev/report_problem.js';
 import type { ActorStore, CallDiagnostics, ToolCallTelemetryProperties, ToolEntry, ToolStatus } from '../types.js';
@@ -175,9 +180,11 @@ export async function prepareToolCall(params: {
 
     const actorName = extractActorName(tool, args as Record<string, unknown>);
     const actorId = extractActorId(tool);
-    // fetch-actor-details only describes Actors, and only helps if this session serves it.
+    // Actor details describe the original schema; restricted direct tools publish their own in tools/list.
     const schemaHint =
-        tool.type === TOOL_TYPE.ACTOR && tools.has(HELPER_TOOLS.ACTOR_GET_DETAILS)
+        tool.type === TOOL_TYPE.ACTOR &&
+        !getDirectActorPolicy(tool.actorFullName) &&
+        tools.has(HELPER_TOOLS.ACTOR_GET_DETAILS)
             ? `using ${HELPER_TOOLS.ACTOR_GET_DETAILS} tool`
             : 'in tools/list';
 
@@ -225,6 +232,20 @@ export async function prepareToolCall(params: {
             mcpSessionId: params.mcpSessionId,
             input: logSafeArgs,
         });
+        const deniedInputs =
+            tool.type === TOOL_TYPE.ACTOR ? getDeniedDirectActorInputs(tool.actorFullName, toolArgs) : [];
+        if (tool.type === TOOL_TYPE.ACTOR && deniedInputs.length) {
+            return {
+                message: `Invalid arguments for tool "${tool.name}": ${buildDeniedInputsNote(tool.actorFullName, deniedInputs)}`,
+                toolStatus: TOOL_STATUS.SOFT_FAIL,
+                callDiagnostics: {
+                    failure_category: FAILURE_CATEGORY.INVALID_INPUT,
+                    ...buildActorFields(actorName, actorId),
+                },
+                resolvedToolName,
+                decodedArgs,
+            };
+        }
         if (!tool.ajvValidate(toolArgs)) {
             const errors = tool.ajvValidate.errors || [];
             const ajvErrorDetails = extractAjvErrorDetails(errors);
 
@@ -18,7 +18,9 @@ direct actor tools, `search-actors`, `fetch-actor-details`) is mode-agnostic.
 - Tool implementations are grouped by domain, each registered through `registry.ts`:
   - `actors/` — search, details, call, the list of the account's Actors (`get-actor-list`), delete
     (`delete_actor.ts`), the actor-tools factory, the direct actor-tool executor (`actor_executor.ts`),
-    `actor_definition.ts` (fetches and prunes an Actor's definition, `getActorDefinition`), and
+    `actor_definition.ts` (fetches and prunes an Actor's definition, `getActorDefinition`),
+    `actor_tool_contract.ts` (direct-tool input restrictions and defaults, shared by schema generation,
+    the call engine's denied-input check and execution; generic calls use the original contract), and
     `actor_run_response.ts` —
     the one canonical run shape `call-actor` and `get-actor-run` share across sync, task
     and wait-timeout modes: storage IDs plus a `summary` (past) / `nextStep` (one primary
 
@@ -8,6 +8,7 @@ import { redactSkyfirePayId } from '../../utils/logging.js';
 import { buildInvalidInputTexts, respondUserError } from '../../utils/mcp.js';
 import { buildGetActorRunResponse } from '../runs/get_actor_run.js';
 import { abortRunOnSignal, CALL_ACTOR_WAIT_SECS_DEFAULT, fetchActorRunData } from './actor_run_response.js';
+import { buildDirectActorRunInput } from './actor_tool_contract.js';
 
 /**
  * Direct actor tool executor. Mode-agnostic — used in both default and apps modes.
@@ -43,7 +44,9 @@ export const actorExecutor: ActorExecutor = {
 
         let actorRun;
         try {
-            actorRun = await apifyClient.actor(actorFullName).start(actorInput, params.callOptions);
+            actorRun = await apifyClient
+                .actor(actorFullName)
+                .start(buildDirectActorRunInput(actorFullName, actorInput), params.callOptions);
         } catch (error) {
             // Platform can reject input our own AJV gate passed (see isActorInputValidationError).
             if (!isActorInputValidationError(error)) throw error;
 
@@ -0,0 +1,65 @@
+import type { ActorInputSchema } from '../../types.js';
+
+type DirectActorPolicyConfig = {
+    defaults?: Readonly<Record<string, unknown>>;
+    deniedInputs?: readonly string[];
+    /** Why, as served to the agent in the description and the refusal. */
+    deniedInputsReason?: string;
+};
+
+/** MCP-only contracts; the Actor's original API contract stays unchanged (#1574, #1575). */
+const DIRECT_ACTOR_POLICIES: Readonly<Record<string, DirectActorPolicyConfig>> = {
+    'apify/website-content-crawler': {
+        defaults: { respectRobotsTxtFile: true },
+        deniedInputs: ['pageFunction', 'initialCookies'],
+        deniedInputsReason:
+            'page code can act on the crawled sites and session cookies can give access to accounts, which a read-only tool must not allow',
+    },
+};
+
+export function getDirectActorPolicy(actorFullName: string): DirectActorPolicyConfig | undefined {
+    return DIRECT_ACTOR_POLICIES[actorFullName];
+}
+
+export function buildDirectActorContract(actorFullName: string, input: ActorInputSchema | undefined) {
+    const policy = getDirectActorPolicy(actorFullName);
+    if (!policy || !input) return { input, description: '' };
+
+    const effectiveInput = structuredClone(input);
+    const deniedInputs = policy.deniedInputs ?? [];
+    for (const name of deniedInputs) delete effectiveInput.properties[name];
+    effectiveInput.required = effectiveInput.required?.filter((name) => !deniedInputs.includes(name));
+    for (const [name, value] of Object.entries(policy.defaults ?? {})) {
+        if (effectiveInput.properties[name]) effectiveInput.properties[name].default = value;
+    }
+
+    return {
+        input: effectiveInput,
+        description: deniedInputs.length ? buildDeniedInputsNote(actorFullName, deniedInputs) : '',
+    };
+}
+
+/** One sentence for the description and the refusal: what is off, that the Actor allows it, why, and the consequence. */
+export function buildDeniedInputsNote(actorFullName: string, names: readonly string[]): string {
+    const reason = getDirectActorPolicy(actorFullName)?.deniedInputsReason;
+    const list = names.map((name) => `"${name}"`).join(' and ');
+    const [verb, pronoun] = names.length > 1 ? ['are', 'them'] : ['is', 'it'];
+    return `${list} ${verb} not accepted by this tool, although the Actor supports ${pronoun}${reason ? `: ${reason}` : ''}, so this tool rejects ${pronoun}.`;
+}
+
+/**
+ * Denied inputs are absent from the served schema, but AJV keeps undeclared fields unless the Actor's
+ * schema sets `additionalProperties: false`, in which case it strips them. Either way the run would
+ * proceed, so the call is checked before validation.
+ */
+export function getDeniedDirectActorInputs(actorFullName: string, args: Record<string, unknown>): string[] {
+    return (getDirectActorPolicy(actorFullName)?.deniedInputs ?? []).filter((name) => name in args);
+}
+
+/** AJV does not fill defaults, so the direct tool must send its overrides explicitly. */
+export function buildDirectActorRunInput(
+    actorFullName: string,
+    input: Record<string, unknown>,
+): Record<string, unknown> {
+    return { ...getDirectActorPolicy(actorFullName)?.defaults, ...input };
+}
@@ -41,6 +41,7 @@ import { buildActorInputSchema, fixedAjvCompile } from '../actor_input_schema.js
 import { actorNameToToolName, isActorBlockedUnderPaymentProvider, resolveActorToolMode } from '../actor_tool_naming.js';
 import { buildEnrichedDirectActorOutputSchema, actorRunOutputSchema } from '../structured_output_schemas.js';
 import { CALL_ACTOR_WAIT_SECS_DEFAULT, WAIT_SECS_MAX } from './actor_run_response.js';
+import { buildDirectActorContract } from './actor_tool_contract.js';
 
 /**
  * MCP-only opt-in injected next to the Actor's own input fields. Same contract as `call-actor`'s
@@ -134,9 +135,9 @@ function isReadOnlyActor({ actor, definition }: ActorInfo): boolean {
  */
 export async function getNormalActorsAsTools(
     actorsInfo: ActorInfo[],
-    options?: { mcpSessionId?: string; actorStore?: ActorStore },
+    options?: { mcpSessionId?: string; actorStore?: ActorStore; isDirectTool?: boolean },
 ): Promise<ToolEntry[]> {
-    const { mcpSessionId, actorStore } = options ?? {};
+    const { mcpSessionId, actorStore, isDirectTool = true } = options ?? {};
     const tools: ToolEntry[] = [];
 
     for (const actorInfo of actorsInfo) {
@@ -145,10 +146,13 @@ export async function getNormalActorsAsTools(
         if (!definition) continue;
 
         const { actorFullName, description: actorDescription } = definition;
-        const isReadOnly = isReadOnlyActor(actorInfo);
+        const contract = isDirectTool
+            ? buildDirectActorContract(actorFullName, definition.input)
+            : { input: definition.input, description: '' };
+        const isReadOnly = isReadOnlyActor({ ...actorInfo, definition: { ...definition, input: contract.input } });
         const isRag = actorFullName === RAG_WEB_BROWSER;
         const isWebFetch = actorFullName === WEB_FETCH;
-        const { inputSchema } = buildActorInputSchema(definition.actorFullName, definition.input, isRag);
+        const { inputSchema } = buildActorInputSchema(definition.actorFullName, contract.input, isRag);
 
         // Inject the MCP-only `waitSecs` opt-in before AJV compile so the LLM can cap the wait.
         const inputSchemaWithWaitSecs = inputSchema as { properties?: Record<string, unknown> };
@@ -167,6 +171,7 @@ ${hasTool(HELPER_TOOLS.ACTOR_CALL) ? `Use this tool instead of the "${HELPER_TOO
             } else if (isWebFetch) {
                 description += `\n\n${WEB_FETCH_ADDITIONAL_DESC}`;
             }
+            if (contract.description) description += `\n\n${contract.description}`;
             return description;
         };
 
@@ -350,9 +355,10 @@ export async function getActorsAsTools(
         mcpSessionId?: string;
         actorStore?: ActorStore;
         paymentProvider?: PaymentProvider;
+        isDirectTool?: boolean;
     },
 ): Promise<ActorsAsToolsResult> {
-    const { mcpSessionId, actorStore, paymentProvider } = options ?? {};
+    const { mcpSessionId, actorStore, paymentProvider, isDirectTool = true } = options ?? {};
     log.debug('Fetching Actors as tools', {
         actorNames: actorIdsOrNames,
         mcpSessionId,
@@ -429,7 +435,7 @@ export async function getActorsAsTools(
     }
 
     const [normalTools, mcpServerTools] = await Promise.all([
-        getNormalActorsAsTools(normalActorsInfo, { mcpSessionId, actorStore }),
+        getNormalActorsAsTools(normalActorsInfo, { mcpSessionId, actorStore, isDirectTool }),
         getMCPServersAsTools(actorMCPServersInfo, apifyClient.token, mcpSessionId),
     ]);
 
 
@@ -477,6 +477,7 @@ export async function resolveAndValidateActor(params: {
 
     const { tools, errors } = await getActorsAsTools([actorName], apifyClient, {
         mcpSessionId: toolArgs.mcpSessionId,
+        isDirectTool: false,
     });
 
     // NOT_FOUND falls through to the structured "Actor not found" response below.
 
@@ -148,6 +148,21 @@ describe('actorExecutor', () => {
         });
     });
 
+    describe('direct Actor defaults', () => {
+        it.each([
+            [{}, true],
+            [{ respectRobotsTxtFile: false }, false],
+            [{ respectRobotsTxtFile: true }, true],
+        ])('prepares WCC input %j with robots.txt %s', async (input, expected) => {
+            const { params, spies } = buildParams(
+                { url: 'https://example.com', ...input },
+                { actorFullName: 'apify/website-content-crawler' },
+            );
+            await actorExecutor.executeActorTool(params);
+            expect(spies.startInput).toEqual({ url: 'https://example.com', respectRobotsTxtFile: expected });
+        });
+    });
+
     describe('platform input-validation error', () => {
         function invalidInputError(message: string): ApifyApiError {
             return new ApifyApiError(
 
@@ -193,6 +193,60 @@ describe('getNormalActorsAsTools()', () => {
         });
     });
 
+    describe('direct Actor contract', () => {
+        const actorInfo = createMockActorInfo('apify/website-content-crawler', {
+            ...LIMITED,
+            inputProperties: {
+                respectRobotsTxtFile: { type: 'boolean', default: false },
+                pageFunction: { type: 'string', editor: 'hidden', default: '' },
+                initialCookies: { type: 'array', editor: 'json', isSecret: true },
+            },
+        });
+
+        it('serves restricted inputs and derives read-only annotations without changing the source', async () => {
+            const original = structuredClone(actorInfo);
+            const [tool] = await getNormalActorsAsTools([actorInfo]);
+            expect(tool.inputSchema.properties).not.toHaveProperty('pageFunction');
+            expect(tool.inputSchema.properties).not.toHaveProperty('initialCookies');
+            expect(tool.inputSchema.properties?.respectRobotsTxtFile).toMatchObject({ default: true });
+            expect(tool.annotations).toMatchObject({ readOnlyHint: true, destructiveHint: false });
+            expect(tool.description).toContain('pageFunction');
+            expect(tool.description).toContain('initialCookies');
+            expect(actorInfo).toEqual(original);
+        });
+
+        it('serves a plain object schema without composition keywords', async () => {
+            // OpenAI rejects a function schema with allOf/anyOf/oneOf/not at the top level, strict or not.
+            const [tool] = await getNormalActorsAsTools([actorInfo]);
+            for (const keyword of ['allOf', 'anyOf', 'oneOf', 'not'])
+                expect(tool.inputSchema).not.toHaveProperty(keyword);
+            expect(tool.ajvValidate({ url: 'https://example.com', respectRobotsTxtFile: false })).toBe(true);
+        });
+
+        it('removes denied fields from required', async () => {
+            const info = structuredClone(actorInfo);
+            info.definition.input!.required = ['url', 'initialCookies'];
+            const [tool] = await getNormalActorsAsTools([info]);
+            expect(tool.inputSchema.required).toEqual(['url']);
+            expect(tool.ajvValidate({ url: 'https://example.com' })).toBe(true);
+        });
+
+        it('retains permission checks and other secret inputs', async () => {
+            const fullPermissions = structuredClone(actorInfo);
+            fullPermissions.actor.actorPermissionLevel = 'FULL_PERMISSIONS';
+            const otherSecret = structuredClone(actorInfo);
+            otherSecret.definition.input!.properties.password = {
+                type: 'string',
+                title: 'Password',
+                description: 'Password',
+                isSecret: true,
+            };
+            for (const info of [fullPermissions, otherSecret]) {
+                expect(await getAnnotations(info)).toMatchObject({ readOnlyHint: false, destructiveHint: true });
+            }
+        });
+    });
+
     // Regression: #1532 — the RAG description named apify/web-fetch when the session did not serve it.
     it('names apify/web-fetch in the RAG description only when its tool is served', async () => {
         const [tool] = await getNormalActorsAsTools([createMockActorInfo(RAG_WEB_BROWSER)]);