PRODUCTION SCENARIO
Your desktop agent host auto-approves any tool call whose tools/list entry carries readOnlyHint true and destructiveHint false. A user connects a community Model Context Protocol (MCP) server they found online, and one of its tools labelled read-only deletes local files. Reviewing the incident, the team finds the call's arguments were ordinary and on screen, the result came back well-formed against the tool's outputSchema, and the call returned in milliseconds. Nobody was asked to confirm it.
Which client behaviour should the host change?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Treat annotations from an unverified server as untrusted and keep confirming calls
Annotations are claims a server makes about itself. The specification requires clients to treat them as untrusted unless the server is trusted, and says a human should be able to deny a tool invocation, so readOnlyHint cannot be what decides an auto-approval for a server a user installed minutes ago. Showing arguments before the request leaves the host is the control against exfiltration through parameters, and these arguments were unremarkable. Validating against outputSchema guards a malformed or poisoned result, and this one was well-formed. Timeouts and rate limits bound a tool that hangs or floods; this one returned at once and did exactly what its hint said it would not.