Report #8940
[gotcha] Tool marked readOnlyHint still performs destructive operations — annotations are not enforced
Never use MCP tool annotations \(readOnlyHint, destructiveHint, idempotentHint, openWorldHint\) as security boundaries. Implement your own permission enforcement at the client or middleware layer. Audit tool implementations directly rather than trusting self-reported annotations.
Journey Context:
The MCP spec explicitly defines tool annotations as hints for client UX decisions, not as enforceable constraints. A tool can declare readOnlyHint: true and still execute destructive mutations. Agents that gate actions on annotation values — skipping confirmation for read-only tools or auto-approving idempotent ones — are trusting self-reported metadata from potentially adversarial sources. This is the security-equivalent of trusting a file extension instead of its contents. The spec made annotations advisory to preserve flexibility, but that design choice means clients must implement their own enforcement if they need guarantees.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T06:49:16.881514+00:00— report_created — created