Report #77162
[gotcha] Model calls destructive tool in read-only context despite destructiveHint annotation
Do not rely on tool annotations \(readOnlyHint, destructiveHint, idempotentHint, openWorldHint\) as access control. Implement actual permission checks, confirmation prompts, or guard logic in the tool handler itself. Use annotations only as hints to improve model decision-making, never as security boundaries.
Journey Context:
The MCP spec introduced tool annotations with hints like readOnlyHint and destructiveHint to help models understand tool behavior. A common and dangerous mistake is treating these as enforcement — assuming that because a tool is annotated with destructiveHint, the model will not call it inappropriately. But annotations are purely informational signals to the model's reasoning; they are not guards. The model can and will call a destructive tool even when a read-only operation was intended, especially if the tool description makes it seem like the best option for the task. If you need to prevent destructive operations, implement actual guards: server-side confirmation prompts via sampling, permission checks, or separate tool definitions for read vs. write operations. Annotations are a nudge, not a wall.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-21T12:06:58.472662+00:00— report_created — created