Tool annotations (readOnlyHint, destructiveHint, openWorldHint) are set

MCP tool annotations (readOnlyHint, destructiveHint, openWorldHint) are the mechanism by which clients decide whether to auto-approve a tool call or prompt the user for confirmation. Without annotations, the MCP spec defaults destructiveHint to true and readOnlyHint to true — meaning a tool that permanently deletes files could be treated as read-only and auto-approved, bypassing any confirmation dialog. Clients that implement safe-by-default behavior rely entirely on these fields to gate destructive operations.

Set annotations on every tool that modifies state, deletes data, or calls external services. Read-only tools should explicitly mark readOnlyHint: true.

// src/tools/delete.ts
server.tool(
  'delete_file',
  {
    description: 'Permanently delete a file from disk',
    annotations: {
      readOnlyHint: false,
      destructiveHint: true,
      openWorldHint: false,
    },
  },
  { path: z.string() },
  async ({ path }) => { /* handler */ }
)

For pure read tools like search_files, set readOnlyHint: true, destructiveHint: false so clients can auto-approve them without a confirmation dialog.