Tool annotations are hints

MCP tool definitions can advertise read-only behavior, destructiveness, idempotency and whether they reach external systems. A changed advertisement can affect an integration's review and retry policy.

The defaults are cautious: readOnlyHint=false, destructiveHint=true, idempotentHint=false and openWorldHint=true. Destructive and idempotent hints are meaningful for tools that write.

A useful release check

If a tool previously advertised readOnlyHint=true and an update omits the hint, its effective default becomes false. Callstead flags that change for review. It does not assume that the tool actually started writing, or that the previous advertisement was trustworthy.

Likewise, a recorded zero side-effect count is only as reliable as the recorder and test conditions. It cannot establish that retries are safe in every state.

Keep authorization and retry controls independent from these hints. The MCP maintainers' explanation describes what annotations can and cannot establish.