{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-18T19:34:16.969Z",
  "record_id": "VXI-EXT-PROCUREMENT-MCP-TOOL-ANNOTATIONS-HINTS-NOT-PERMISSION-ENFORCEMENT-01-v1",
  "record_kind": "external_reference",
  "title": "MCP: Tool annotations describe hints, not enforced authority",
  "system": "Model Context Protocol",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Can an agent rely on MCP readOnlyHint, destructiveHint or idempotentHint as enforced permissions?",
  "near_questions": [
    "Does MCP readOnlyHint guarantee that a tool cannot write?",
    "Can destructiveHint false be treated as permission to execute?",
    "Does MCP idempotentHint make retrying an external action safe?",
    "What independent evidence is needed to trust MCP tool annotations?"
  ],
  "supported_claims": [
    {
      "claim": "MCP 2026-07-28 defines ToolAnnotations as hints that are not guaranteed to describe behavior faithfully, and warns against tool-use decisions based on untrusted servers' annotations. readOnlyHint describes mutation, destructiveHint concerns destructive rather than additive updates, and idempotentHint concerns repeated arguments. These declarations do not establish a tested authorization or execution boundary.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Certified read-only execution, granted permission or verified idempotency",
    "Buyer deployment testing, live runtime enforcement, certification or permission to act",
    "Expanded capabilities or licences for existing INDEX executables"
  ],
  "public_summary": "MCP 2026-07-28 defines ToolAnnotations as hints that are not guaranteed to describe behavior faithfully, and warns against tool-use decisions based on untrusted servers' annotations. readOnlyHint describes mutation, destructiveHint concerns destructive rather than additive updates, and idempotentHint concerns repeated arguments. These declarations do not establish a tested authorization or execution boundary.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Schema Reference - Model Context Protocol",
    "source_url": "https://modelcontextprotocol.io/specification/2026-07-28/schema",
    "checked_on": "2026-10-18",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-MCP-TOOL-ANNOTATIONS-HINTS-NOT-PERMISSION-ENFORCEMENT-01-v1",
    "candidate_record_sha256": "448595cd7689190810e0c8a008cfeefabd6bf7844c39da798db0d1dba20698f7",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "MCP 2026-07-28 defines ToolAnnotations as hints that are not guaranteed to describe behavior faithfully, and warns against tool-use decisions based on untrusted servers' annotations. readOnlyHint describes mutation, destructiveHint concerns destructive rather than additive updates, and idempotentHint concerns repeated arguments. These declarations do not establish a tested authorization or execution boundary.",
    "required_buyer_context": "Negotiated MCP version, server identity and complete annotated tool schema. Effective execution identity, permissions and independently enforced restrictions. Action-specific side effects, retry behavior and authorized task scope. Buyer deployment not inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-18",
    "claim_to_check": "Can an agent rely on MCP readOnlyHint, destructiveHint or idempotentHint as enforced permissions?",
    "documented_statement": {
      "status": "documented",
      "statement": "MCP 2026-07-28 defines ToolAnnotations as hints that are not guaranteed to describe behavior faithfully, and warns against tool-use decisions based on untrusted servers' annotations. readOnlyHint describes mutation, destructiveHint concerns destructive rather than additive updates, and idempotentHint concerns repeated arguments. These declarations do not establish a tested authorization or execution boundary.",
      "source_ids": [
        "mcp-annotations-current"
      ]
    },
    "review_inference": {
      "status": "review_inference",
      "statement": "A hint cannot replace an authority check or evidence that repeated external effects are prevented.",
      "source_ids": [
        "mcp-annotations-current"
      ]
    },
    "buyer_evidence_required": [
      "Negotiated MCP version, server identity and complete annotated tool schema.",
      "Effective execution identity, permissions and independently enforced restrictions.",
      "Action-specific side effects, retry behavior and authorized task scope."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Refuse automatic approval or safe-retry guarantees derived solely from tool annotations."
    },
    "unknowns": "The server's actual behavior and permission enforcement have not been tested.",
    "unknown_finding": {
      "status": "unknown",
      "statement": "The server's actual behavior and permission enforcement have not been tested."
    },
    "evidence_sources": [
      {
        "source_id": "mcp-annotations-current",
        "url": "https://modelcontextprotocol.io/specification/2026-07-28/schema",
        "final_url": "https://modelcontextprotocol.io/specification/2026-07-28/schema",
        "title": "Schema Reference - Model Context Protocol",
        "checked_on": "2026-10-18",
        "captured_at_utc": "2026-10-18T19:26:31.376Z",
        "version_context": "MCP specification 2026-07-28, ToolAnnotations schema.",
        "sha256": "f4019cf8a1130a26c43a53ac0685c1db35f89a78987f6fd65cf54a35615693fe",
        "bytes": 2336349,
        "hash_basis": "Decoded HTTP response body bytes; identifies captured content, not truth or certification",
        "reviewed_sections": [
          "ToolAnnotations",
          "readOnlyHint",
          "destructiveHint",
          "idempotentHint"
        ],
        "capture_status": 200,
        "rights_review": "Factual paraphrase and source metadata only; response body retained privately and not redistributed."
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Documentation review only; no supplier clearance, configuration audit, observed execution or certification of the buyer's claim.",
    "paid_value": {
      "decision_context": "Identify which declared controls can support an agent authority decision.",
      "free": "Complete review, sources, practical questions and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Recheck negotiated specification, server version and annotation changes before relying on a tool inventory."
    },
    "buyer_relevance": "Identify which declared controls can support an agent authority decision.",
    "refusal_conditions": [
      "Refuse automatic approval or safe-retry guarantees derived solely from tool annotations."
    ]
  },
  "niche": {
    "niche_id": "agent-authority-action-evidence",
    "label": "Agent Authority & Action Evidence",
    "classification_id": "governance",
    "classification_label": "Agent Governance & Policy Boundaries",
    "topic_id": "governance",
    "buyer_intent": "Identify which declared controls can support an agent authority decision.",
    "comparison_role": "supplementary_discovery"
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#mcp-tool-annotations-hints-not-permission-enforcement",
  "machine_readable_record": "/varexis-index/records/mcp-tool-annotations-hints-not-permission-enforcement.json"
}