Verified65% confidenceCautionExact time
MCP tool annotations (such as read-only, destructive, idempotent, and open-world) are hints rather than guarantees, and applications should treat them as untrusted information unless the server itself is trusted.
3
Sources
65%
Confidence
Long-term
Relevance
10/5/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedAnnotation declarations on MCP servers have no enforcement validation mechanism at the protocol level, creating a supply-chain trust problem where an attacker can publish a malicious server claiming to be read-only while performing arbitrary write operations.80% similarUnverifiedHow to ensure that sensitive call content of MCP servers is not leaked when connecting to third-party analytics tools is a data privacy issue that remains to be verified.77% similarUnverifiedCritics point out that an MCP Server with file system write permissions, once exploited by malicious tools, would present an attack surface harder to audit than traditional API integrations76% similarUnverifiedThe official Learn documentation notes that autonomously running or misconfigured clients may execute destructive operations, and that flags for blocking destructive operations have not yet been standardized in the MCP protocol.74% similarUnverifiedOne of the security risks of MCP is prompt injection attacks, where malicious data sources may embed instructions in returned content to induce the model to perform unauthorized operations.72% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/977134API
curl https://kongchang.com/api/v1/knowledge/claims/977134MCP
get_claim(id=977134)