--- title: Tool Annotations as Risk Vocabulary: What Hints Can and... description: MCP tool annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) give clients a basic risk vocabulary for agentic tool calls, but the spec... canonical: https://daily.dev/posts/tool-annotations-as-risk-vocabulary-what-hints-can-and-can-t-do-kc5gza150 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Tool Annotations as Risk Vocabulary: What Hints Can and Can't Do | daily.dev og:description: MCP tool annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) give clients a basic risk vocabulary for agentic tool calls, but the spec... og:url: https://daily.dev/posts/tool-annotations-as-risk-vocabulary-what-hints-can-and-can-t-do-kc5gza150 og:image: https://api.daily.dev/og/posts/KC5GZA150.png og:image:alt: Tool Annotations as Risk Vocabulary: What Hints Can and Can't Do og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Tool Annotations as Risk Vocabulary: What Hints Can and Can't Do **[Model Context Protocol](https://daily.dev/sources/modelcontextprotocol-blog)** · 12 min read · 0 upvotes · 0 comments ## Summary MCP tool annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) give clients a basic risk vocabulary for agentic tool calls, but the spec treats them as untrustworthy hints rather than enforceable contracts. Five open Specification Enhancement Proposals seek to add annotations covering trust, sensitivity, and unsafe output, partly motivated by Simon Willison's 'lethal trifecta' (private data access, untrusted content exposure, external communication) which enables data exfiltration when all three combine in a session. A newly forming Tool Annotations Interest Group, with members from Microsoft, OpenAI, AWS, Cloudflare, and Anthropic, is developing a framework of five questions to evaluate new annotation proposals, emphasizing that real safety guarantees belong in deterministic controls like sandboxing and network policy, not in soft hints. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Simon Willison's lethal trifecta and how does it relate to MCP servers? The lethal trifecta names three capabilities that together enable data theft by an AI agent: access to private data, exposure to untrusted content, and the ability to communicate externally. If an agent session has all three, an attacker who controls one piece of untrusted content, such as a calendar event, can trick the model into leaking private data. Researchers demonstrated this using a malicious Google Calendar event, an MCP calendar server, and a local code execution tool. _Teams wiring up multi-tool MCP agents can track emerging annotation proposals for exfiltration risk on daily.dev._ ### What do the readOnlyHint, destructiveHint, idempotentHint, and openWorldHint fields mean in the MCP ToolAnnotations interface? readOnlyHint indicates whether a tool modifies its environment, destructiveHint indicates whether a modification is destructive rather than additive, idempotentHint indicates whether the tool can be safely called again with the same arguments, and openWorldHint indicates whether the tool interacts with an open world of external entities. All four are optional booleans shipped in the 2025-03-26 MCP spec revision, and the defaults are pessimistic: non-read-only, potentially destructive, non-idempotent, and open-world. _Developers building MCP servers can reference annotation defaults like these on daily.dev while shaping tool safety._ ### Can MCP tool annotations be trusted to enforce safety for agentic tools? No, MCP tool annotations are explicitly untrusted hints, not enforceable contracts. An untrusted server can declare readOnlyHint: true and still delete files, so the specification requires clients to treat annotations from untrusted servers as informational only. Real safety guarantees against exfiltration or destructive actions must come from network controls, sandboxing, or authorization layers rather than boolean annotation flags. _Anyone weighing MCP client safety design can compare enforcement approaches like this on daily.dev._ ## Similar posts on daily.dev - [Tool Poisoning: A New Attack Surface for AI Agents](https://daily.dev/posts/tool-poisoning-a-new-attack-surface-for-ai-agents-qdfggnrs7) · Medium · 0 upvotes · 0 comments - [Why More MCP Tools Can Make an AI Agent Less Useful](https://daily.dev/posts/why-more-mcp-tools-can-make-an-ai-agent-less-useful-piqjmps6m) · Dev Genius · 3 upvotes · 1 comments - [Understanding MCP Tool Poisoning Attacks](https://daily.dev/posts/understanding-mcp-tool-poisoning-attacks-hwnewp5yg) · Descope · 1 upvotes · 0 comments - [Securing MCP: A Control Plane for Agent Tool Execution](https://daily.dev/posts/securing-mcp-a-control-plane-for-agent-tool-execution-gvibue72c) · DevBlogs · 0 upvotes · 0 comments - [MCP Security: Understanding Vulnerabilities in Model Context Protocol](https://daily.dev/posts/mcp-security-understanding-vulnerabilities-in-model-context-protocol-hcscknky1) · marmelab · 4 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#llm](https://daily.dev/tags/llm), [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/tool-annotations-as-risk-vocabulary-what-hints-can-and-can-t-do-kc5gza150) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Tool Annotations as Risk Vocabulary: What Hints Can and Can't Do","url":"https://daily.dev/posts/tool-annotations-as-risk-vocabulary-what-hints-can-and-can-t-do-kc5gza150","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tool-annotations-as-risk-vocabulary-what-hints-can-and-can-t-do-kc5gza150"},"datePublished":"2026-08-23T12:16:57.831Z","dateModified":"2026-08-23T12:19:28.070Z","description":"MCP tool annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) give clients a basic risk vocabulary for agentic tool calls, but the spec...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ccad778d24e1fca3aa1c66575a7bfbf3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ccad778d24e1fca3aa1c66575a7bfbf3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Model Context Protocol","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Model Context Protocol","logo":"https://media.daily.dev/image/upload/s--ORAgfri4--/f_auto,q_auto/v1787487408/logos/modelcontextprotocol-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/modelcontextprotocol-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tool-annotations-as-risk-vocabulary-what-hints-can-and-can-t-do-kc5gza150","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,llm,ai-agents,mcp,prompt-injection","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Model Context Protocol","item":"https://daily.dev/sources/modelcontextprotocol-blog"},{"@type":"ListItem","position":3,"name":"Tool Annotations as Risk Vocabulary: What Hints Can and Can't Do"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/tool-annotations-as-risk-vocabulary-what-hints-can-and-can-t-do-kc5gza150#faq","mainEntity":[{"@type":"Question","name":"What is Simon Willison's lethal trifecta and how does it relate to MCP servers?","acceptedAnswer":{"@type":"Answer","text":"The lethal trifecta names three capabilities that together enable data theft by an AI agent: access to private data, exposure to untrusted content, and the ability to communicate externally. If an agent session has all three, an attacker who controls one piece of untrusted content, such as a calendar event, can trick the model into leaking private data. Researchers demonstrated this using a malicious Google Calendar event, an MCP calendar server, and a local code execution tool. Teams wiring up multi-tool MCP agents can track emerging annotation proposals for exfiltration risk on daily.dev."}},{"@type":"Question","name":"What do the readOnlyHint, destructiveHint, idempotentHint, and openWorldHint fields mean in the MCP ToolAnnotations interface?","acceptedAnswer":{"@type":"Answer","text":"readOnlyHint indicates whether a tool modifies its environment, destructiveHint indicates whether a modification is destructive rather than additive, idempotentHint indicates whether the tool can be safely called again with the same arguments, and openWorldHint indicates whether the tool interacts with an open world of external entities. All four are optional booleans shipped in the 2025-03-26 MCP spec revision, and the defaults are pessimistic: non-read-only, potentially destructive, non-idempotent, and open-world. Developers building MCP servers can reference annotation defaults like these on daily.dev while shaping tool safety."}},{"@type":"Question","name":"Can MCP tool annotations be trusted to enforce safety for agentic tools?","acceptedAnswer":{"@type":"Answer","text":"No, MCP tool annotations are explicitly untrusted hints, not enforceable contracts. An untrusted server can declare readOnlyHint: true and still delete files, so the specification requires clients to treat annotations from untrusted servers as informational only. Real safety guarantees against exfiltration or destructive actions must come from network controls, sandboxing, or authorization layers rather than boolean annotation flags. Anyone weighing MCP client safety design can compare enforcement approaches like this on daily.dev."}}]} ```