{
  "id": 16736589,
  "title": "readOnlyHint isn't a permission: blocking a destructive MCP tool by policy",
  "url": "https://urgent.news/2026/10/27/readonlyhint-isnt-a-permission-blocking-a-destructive-mcp-tool-by",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-27T10:53:46.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/dvarahq/readonlyhint-isnt-a-permission-blocking-a-destructive-mcp-tool-by-policy-19nm"
  },
  "original_language": "en",
  "account": "MCP tools use hints to indicate whether they only read data or can delete or overwrite it. However, two issues arise with these hints in practice. First, they are often missing, and second, they can be incorrect. For example, a server in a catalogue marked 15 delete tools as read-only. The MCP specification advises clients to treat tool annotations as untrusted unless they come from trusted servers. This suggests that the decision about what an agent may do should be made elsewhere, not in the tool's description of itself. A policy can be implemented that denies certain destructive actions regardless of the tool's annotations. For instance, a rule can be set up to deny the delete_customer tool, which permanently deletes a customer record. This rule does not rely on the tool's annotations and simply denies the action. When the gateway receives a request to run the delete_customer tool, it applies the workspace's rules and responds with an error message, preventing the irreversible action. This approach ensures that irreversible actions require explicit approval, rather than being silently denied based on potentially incorrect or missing hints.",
  "summary": "MCP lets a tool describe itself. readOnlyHint: true says \"I only read\". destructiveHint: true says \"I can delete or overwrite something\". Clients can use those hints to decide when to ask a person before running a tool. Two things go wrong with that in practice. The hint is often missing. We looked at about 20,000 MCP tools for a report on MCP tool annotations . In Docker's MCP Catalog, 69% of…",
  "key_points": [
    "MCP tools have hints indicating read-only or destructive actions",
    "Hints often missing or incorrect in practice",
    "Policy can block destructive actions regardless of hints"
  ],
  "editors_take": "Shifting control from untrusted tool annotations to centralized workspace policies prevents irreversible data loss by ensuring destructive actions are governed by explicit rules rather than unreliable metadata.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}