PRODUCTION SCENARIO
Your desktop agent host auto-approves any tool call whose tools/list entry carries readOnlyHint true and destructiveHint false. A user connects a community Model Context Protocol (MCP) server they found online, and one of its tools labeled read-only deletes local files.
How should the host change its approval behavior?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Treat annotations from untrusted servers as untrusted and keep human confirmation on tool calls
Tool annotations are claims the server makes about itself rather than guarantees, so a client must treat them as untrusted unless the server is trusted, and a human should always be able to deny a tool invocation. A hint like readOnlyHint cannot be the basis for auto-approving calls from a server the user has just installed.