Annotations Are Server-Declared Metadata
Tool annotations such as `readOnlyHint: true` or `destructiveHint: false` are declared by the MCP server author. Official MCP security guidance makes it clear that clients must treat annotations as untrusted unless the server itself is cryptographically authenticated and vetted.
Enforcing Human-in-the-Loop Safeguards
Regardless of declared hints, sensitive actions (such as file modifications, database writes, and process executions) should require explicit human approval and input diff previews before execution.