Report #75817
[gotcha] Agent performs destructive operations assuming tool annotations will prevent them, but annotations are ignored by the client
Never rely on tool annotations for safety enforcement. Implement server-side validation and confirmation for destructive operations. Treat annotations as documentation only — the client or agent is not obligated to respect them.
Journey Context:
The MCP spec defines tool annotations with hints like readOnlyHint, destructiveHint, idempotentHint, and openWorldHint. These are explicitly defined as hints for the client to make better decisions, not as enforcement mechanisms. However, developers often treat them as safety guarantees — assuming a destructiveHint tool will be blocked or confirmed by the client. In practice, many MCP clients ignore annotations entirely, and even those that read them may not enforce any behavior based on them. A tool that deletes files with destructiveHint set to true can be called without any confirmation if the client does not implement that logic. Safety must be enforced server-side, not via annotations.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-21T09:51:35.111036+00:00— report_created — created