Title: 13 of 15 tools annotated destructiveHint:true / readOnlyHint:false, but most are pure read/query operations
Body:
Querying tools/list on v0.10.8 (darwin-arm64 release binary), the tool annotations look like they were stamped with one shared default rather than set per-tool. Every tool except list_projects (correctly readOnlyHint: true) and ingest_traces gets the identical {"readOnlyHint": false, "destructiveHint": true, "idempotentHint": true, "openWorldHint": false}, including tools that only read/query and never mutate anything:
search_graph, query_graph, trace_path, get_code_snippet, get_graph_schema, get_architecture, search_code, index_status, check_index_coverage, detect_changes — all marked destructiveHint: true, readOnlyHint: false
By contrast, delete_project (an actual destructive op) gets the same annotation as get_architecture (a pure read) — so the hints don't currently distinguish "this deletes data" from "this reads a schema."
Why it matters: MCP clients and agent runtimes that respect these hints to gate auto-approval (e.g. only auto-run readOnlyHint: true tools without explicit user confirmation) will unnecessarily prompt for confirmation — or skip entirely — on 10 of your 15 tools that are actually safe reads. I hit this directly running a crash-fuzzing pass with mcp-fuzz, which only auto-tests readOnlyHint: true tools by default: it correctly tested just 1 of 15 tools until I explicitly opted into --include-destructive.
Real read-only candidates based on tool name/description: search_graph, query_graph, trace_path, get_code_snippet, get_graph_schema, get_architecture, search_code, index_status, check_index_coverage, detect_changes.
Happy to send more detail on the exact tools/list output if useful, but wanted to flag this first in case there's a reason for the current blanket annotation I'm missing.
Title: 13 of 15 tools annotated destructiveHint:true / readOnlyHint:false, but most are pure read/query operations
Body:
Querying
tools/liston v0.10.8 (darwin-arm64 release binary), the tool annotations look like they were stamped with one shared default rather than set per-tool. Every tool exceptlist_projects(correctlyreadOnlyHint: true) andingest_tracesgets the identical{"readOnlyHint": false, "destructiveHint": true, "idempotentHint": true, "openWorldHint": false}, including tools that only read/query and never mutate anything:search_graph,query_graph,trace_path,get_code_snippet,get_graph_schema,get_architecture,search_code,index_status,check_index_coverage,detect_changes— all markeddestructiveHint: true,readOnlyHint: falseBy contrast,
delete_project(an actual destructive op) gets the same annotation asget_architecture(a pure read) — so the hints don't currently distinguish "this deletes data" from "this reads a schema."Why it matters: MCP clients and agent runtimes that respect these hints to gate auto-approval (e.g. only auto-run
readOnlyHint: truetools without explicit user confirmation) will unnecessarily prompt for confirmation — or skip entirely — on 10 of your 15 tools that are actually safe reads. I hit this directly running a crash-fuzzing pass with mcp-fuzz, which only auto-testsreadOnlyHint: truetools by default: it correctly tested just 1 of 15 tools until I explicitly opted into--include-destructive.Real read-only candidates based on tool name/description:
search_graph,query_graph,trace_path,get_code_snippet,get_graph_schema,get_architecture,search_code,index_status,check_index_coverage,detect_changes.Happy to send more detail on the exact
tools/listoutput if useful, but wanted to flag this first in case there's a reason for the current blanket annotation I'm missing.