/research · monthly · October 2026 · first edition

Do MCP servers warn agents before a tool deletes something?

The first edition of a monthly count. MCP lets a server label each tool: read-only, destructive, safe to repeat, reaches the outside world. Agents and the apps that run them use those labels to decide what needs a person's approval. We checked how often the tools that delete, move money, run code, send or write carry them, across every public server 7Maps reaches.

Published Data from October 6, 2026Edition 1
The short version

October 2026 in four numbers.

Across about 14,900 public MCP servers that answered with a tool list, about 126,900 distinct tools. Estimates, rounded; no server or tool is named.

66.3%

of tools that delete, move money, run code or change access are not marked destructive

36%

of tools that delete or erase are not marked destructive

29.6%

of tools that change something carry no annotations at all

35.3%

of servers with high-risk tools mark none of them destructive

By kind of action

What the labels say, next to what the tools do.

Each tool is grouped by what its name and description say it does, never by its own labels. Then we read the labels its server publishes. Bars are drawn to scale, each row adds up to 100%.

Risk labels by kind of action

Share of distinct tools in each group. "Labelled, but not as destructive" includes tools that say outright they are not destructive.

  • Marked destructive
  • Labelled, but not as destructive
  • Says read-only
  • No annotations at all
Delete or erase high riskabout 1,900 tools
64% marked destructive26.2% no annotations
Move money high riskabout 1,000 tools
12.8% marked destructive34.6% no annotations
Run code or deploy high riskabout 1,300 tools
14.8% marked destructive27.6% no annotations
Change access or accounts high riskabout 930 tools
42.4% marked destructive31.1% no annotations
Other high-risk actions high riskabout 840 tools
9.2% marked destructive40.4% no annotations
Send or postabout 1,900 tools
11.2% marked destructive33.3% no annotations
Create or editabout 10,600 tools
15.8% marked destructive28.3% no annotations
Every tool that changes somethingabout 18,500 tools
21.1% marked destructive29.6% no annotations
Show as a table
Kind of actionToolsMarked destructiveLabelled, not destructiveSays read-onlyNo annotations
Delete or eraseabout 1,90064%9.2%0%26.2%
Move moneyabout 1,00012.8%29.5%21.4%34.6%
Run code or deployabout 1,30014.8%31.5%24.6%27.6%
Change access or accountsabout 93042.4%16.8%7.6%31.1%
Other high-risk actionsabout 8409.2%14.8%34.5%40.4%
Send or postabout 1,90011.2%34.3%20.8%33.3%
Create or editabout 10,60015.8%51%4.9%28.3%
Every tool that changes somethingabout 18,50021.1%39.4%9.9%29.6%
Servers

Over half the servers label something. Fewer label the risky part.

The same question asked per server. Identical copies of one tool list count once.

Servers and their labels

Share of about 14,300 distinct servers with a tool list.

56.8%
publish annotations on any tool
26.5%
have at least one high-risk tool
Show as a table
ItemTools or serversShare
Publish annotations on any toolabout 8,100 of about 14,30056.8%
Have at least one high-risk toolabout 3,800 of about 14,30026.5%

Where the risky tools are unlabelled

Of the servers that have tools of each kind.

Have high-risk tools, none marked destructive 35.3%
Have tools that change something, none annotated 28.6%
Show as a table
ItemTools or serversShare
Have high-risk tools, none marked destructiveabout 1,300 of about 3,80035.3%
Have tools that change something, none annotatedabout 1,600 of about 5,60028.6%
Labels that understate

A wrong label is worse than none.

An agent that trusts a read-only label may skip the approval step. These are tools whose label says less than their name does. Some of them are honest (a tool named for running a report may only read), which is why we show them apart.

High-risk tools

Tools that delete, move money, run code, change access or say they do something high risk, about 5,900 distinct tools.

Not marked destructive 66.3%
Labelled read-only or not destructive 34.1%
No annotations at all 30.7%
Show as a table
ItemTools or serversShare
Not marked destructiveabout 3,900 of about 5,90066.3%
Labelled read-only or not destructiveabout 2,000 of about 5,90034.1%
No annotations at allabout 1,800 of about 5,90030.7%

Every tool, by the 7Maps estimate

All about 126,900 distinct tools, with their labels taken into account, as the 7Maps pages show them. 65.4% carry at least one annotation.

Read-only 56.4%
Needs approval 36.2%
High risk 7.4%
Show as a table
ItemTools or serversShare
Read-onlyabout 71,600 of about 126,90056.4%
Needs approvalabout 45,900 of about 126,90036.2%
High riskabout 9,400 of about 126,9007.4%
Tools with any annotationabout 83,000 of about 126,90065.4%
What to do

Labels take a minute to add.

If you build an MCP server

  1. Add annotations to every tool in tools/list. Four hints cover it: readOnlyHint, destructiveHint, idempotentHint and openWorldHint.
  2. Mark tools that only read as readOnlyHint: true. Everything else gets readOnlyHint: false and an honest destructiveHint: true when it deletes, overwrites, pays or can't be undone.
  3. Say it out loud even when the default matches. The spec treats a missing hint as the cautious choice, but many clients only act on hints that are present.
  4. Never mark a tool read-only to skip a confirmation prompt. Agents and reviewers will notice the gap between the label and the name.
{ "name": "delete_item", "description": "Permanently deletes one item.", "inputSchema": { "type": "object", "properties": { "id": { "type": "string" } } }, "annotations": { "title": "Delete item", "readOnlyHint": false, "destructiveHint": true, "idempotentHint": true, "openWorldHint": false } }

In the official TypeScript SDK, pass annotations in the tool's config when you register it; in the Python SDK, pass annotations=ToolAnnotations(...) to the tool decorator.

If your team uses agents

  1. Prefer servers that label their tools. A server that labels every tool has thought about what each one does.
  2. Treat a missing label as "may change something" and keep approval on for it. That is what the MCP specification assumes when a hint is absent.
  3. Treat labels as hints, not proof. They come from the server, so read the tool's description before you allow it to run on its own.
  4. Check before you connect. Every server page on 7Maps shows each tool's estimated risk and whether its server publishes labels, and an agent can ask the same through the 7Maps MCP server.

Open 7Maps

Method and limits

How we count, and where it can be wrong.

Where the data comes from

7Maps checks every remote server in the official MCP registry each day, plus servers their owners add. A check sends only what every MCP client sends first: the handshake and a request for the tool list. It never calls a tool. This edition uses the newest daily check as of October 6, 2026: about 22,800 servers on the map, about 14,900 answered with a tool list.

How tools are counted

  • Identical copies count once. A tool list copied onto many servers counts as one server, and a tool definition (name, description and labels) that appears on many servers counts as one tool. That leaves about 14,300 distinct servers and about 126,900 distinct tools, out of about 266,700 tools listed.
  • Each tool is grouped by what its name and description say it does, using the same automated estimate that sets the risk levels on 7Maps. The tool's own labels are left out of this step, so a label can never move a tool into a safer group.
  • "Marked destructive" means the server sets destructiveHint: true on the tool. "No annotations" means none of the four hints is present.
  • Counts are rounded. Percentages are worked out before rounding and shown to one decimal place. Groups with too few tools to be meaningful show "too few to show".

Limits

  • This is an estimate. The grouping reads names and descriptions, and a name can mislead: a tool called for running a report may only read, and a mild name can hide a risky action. Read the numbers as a fair picture of the whole, never as a verdict on any one server.
  • Under the MCP specification a missing destructiveHint should be read as "may be destructive", so an unlabelled tool is not a false label. In practice many clients only act on labels that are present, which is why we count them.
  • Servers that need sign-in before they list tools are not in the count. Neither are local servers that run on a user's own machine.

What we never publish

No server, tool, publisher or project is named, here or in the data files. We publish totals by group only, at the coarsest level that still answers the question.

Published October 6, 2026, the first edition. A new edition comes out early each month. License CC BY 4.0: use it with a link to this page.

Data and citation

Use it, with a link.

The totals behind every chart, as a spreadsheet and as JSON.

Download the CSVJSON

Cite it as:

7IT Solutions, "MCP Tool Risk Labels, October 2026", https://7it.co.il/research/mcp-tool-annotations/2026-10/

All editions · All research · 7Maps methodology