MCP Schema Default Annotations: Missing Means True
Deep dive into Model Context Protocol specs where unassigned destructiveHint tool annotations default to true.
Stock photo for illustration only, not from the actual event
- MCP specification defines default behaviors for missing ToolAnnotations.
- Omitting destructiveHint evaluates to true under protocol rules.
- The spec explicitly warns clients against trusting annotations blindly.
- Source code audits reveal complexities in counting tool attributes.
Within the ecosystem of artificial intelligence application development, the Model Context Protocol (MCP) establishes intricate architectural structures, particularly regarding tool management through annotations. Developers frequently encounter rigid default rules where unassigned attributes carry profound implications rather than mere absence.
Eugeniya Ivanova published a walkthrough on September 7, 2026, detailing the process of passing an MCP server through the ChatGPT app directory review. One particular section addressed annotations, noting that her scanner evaluated every tool, enforcing explicit values for readOnlyHint, openWorldHint, and destructiveHint. Although the specification permits omitting destructiveHint for read-only tools, the scanner demanded them, prompting her to append destructiveHint: false alongside justifications for over forty annotation values without altering the underlying tool logic.
Stock photo for illustration only, not from the actual event
Conversely, Himanshu Kumar audited a deployed server a week earlier on August 30, 2026, discovering six operational tools with zero declared annotations. His insight captures the essence of the architectural friction.
The ToolAnnotations interface, declared at line 1912 of the schema repository, incorporates four boolean fields, each accompanied by documented defaults and operational consequences when missing. Crucially, lines 1903 to 1908 feature a mandatory advisory note warning that all properties within ToolAnnotations are strictly hints and should never serve as the sole basis for automated client decisions when received from untrusted servers.
"The server did not lie. It said nothing."
Himanshu Kumar
This architectural duality creates a compelling gap within MCP implementations. Consider a memory server shipping a save_memory tool without annotations: a strict spec-compliant client applies default flags treating the call as destructive and open-world, whereas a security-conscious client respects the advisory note and bypasses annotation gates. Both behaviors align with valid sections of the specification, leaving developers to navigate conflicting interpretations of silent servers.
Furthermore, a secondary rule at line 1929 dictates that destructiveHint remains meaningful only when readOnlyHint evaluates to false. For tools declaring readOnlyHint: true, omitting destructiveHint is completely valid, whereas omitting everything causes readOnlyHint to drop to its default false state, inadvertently triggering the default true condition for destructiveHint.
Source: Dev.to
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment