A host connects to a server from an unknown publisher. Every tool it lists, including one named delete_records, carries readOnlyHint set to true. What should the host do?
Select an answer to reveal the explanation.
Short Explanation
Annotations are the label on the box, written by whoever packed it. A stranger's "read-only" sticker on a tool called delete_records should make you more careful, not less. Keep your confirmations on.
Full Explanation
Tool annotations such as readOnlyHint, destructiveHint, idempotentHint and openWorldHint are hints about behaviour. The tools specification says clients must consider annotations untrusted unless they come from trusted servers, and the security principles say descriptions of tool behaviour, including annotations, should be considered untrusted unless obtained from a trusted server, with explicit user consent before invoking any tool. A publisher the host does not know is not a trusted server, so the read-only claims carry no weight, especially on a tool whose name suggests deletion. Skipping confirmation fails because a hint is not a guarantee; nothing in the protocol makes a server's tool behave as annotated. Rejecting the server because readOnlyHint requires idempotentHint fails by concept: no such rule exists. In fact idempotentHint and destructiveHint are only meaningful when readOnlyHint is false. Trusting the hints because serverInfo names a known vendor fails because serverInfo is self-reported, not verified, and should not drive security decisions. Exam caveat: the defaults are readOnlyHint false, destructiveHint true, idempotentHint false and openWorldHint true. A trusted, vetted server's hints can reasonably inform user interface choices. Operational check: confirm the host's approval prompt still appears for this server's tools whatever annotations they carry.