Re-imagining the Web MIDI API security model as well as some other parts... this is just a strawman.

MIDI API.md

Thinking about the security model.

Lets say I'm a making game... I want to just use the system's standard output.

This case handles the user having a standard output port, plus the user has plugged in some other output device.

(function() {
  var midi = navigator.midi, 
      out;
  //going to try to get the output ports... 
  try{
    out = midi.outputs();
    //got it! no problem. 
    outputReady(out);
    
  //could not get access...   
  }catch(e){
    //we don't have permission
    if(e.name === "SecurityError"){
        //request could take "inputs" "outputs" "all"
        midi.request("outputs", success, fail);
    }
  }
  
  //reqested ports can be in an object {inputs: null, outputs: [...]}
  function success(ports){ 
     outputReady(ports.outputs)
  }
  
  function outputReady(out){
    if(out.length > 0){
        ...    
    }
  }
 
  function fail(){}
}());

Having a midi object could give a way to listen to all incoming messages.

navigator.midi.onmessage = function(e){
      
}