Do MCP servers warn agents before a tool deletes something?

If you build an MCP server

1. Add annotations to every tool in tools/list. Four hints cover it: readOnlyHint, destructiveHint, idempotentHint and openWorldHint.
2. Mark tools that only read as readOnlyHint: true. Everything else gets readOnlyHint: false and an honest destructiveHint: true when it deletes, overwrites, pays or can't be undone.
3. Say it out loud even when the default matches. The spec treats a missing hint as the cautious choice, but many clients only act on hints that are present.
4. Never mark a tool read-only to skip a confirmation prompt. Agents and reviewers will notice the gap between the label and the name.

{
  "name": "delete_item",
  "description": "Permanently deletes one item.",
  "inputSchema": { "type": "object", "properties": { "id": { "type": "string" } } },
  "annotations": {
    "title": "Delete item",
    "readOnlyHint": false,
    "destructiveHint": true,
    "idempotentHint": true,
    "openWorldHint": false
  }
}

In the official TypeScript SDK, pass annotations in the tool's config when you register it; in the Python SDK, pass annotations=ToolAnnotations(...) to the tool decorator.

If your team uses agents

1. Prefer servers that label their tools. A server that labels every tool has thought about what each one does.
2. Treat a missing label as "may change something" and keep approval on for it. That is what the MCP specification assumes when a hint is absent.
3. Treat labels as hints, not proof. They come from the server, so read the tool's description before you allow it to run on its own.
4. Check before you connect. Every server page on 7Maps shows each tool's estimated risk and whether its server publishes labels, and an agent can ask the same through the 7Maps MCP server.

Open 7Maps

Where the data comes from

7Maps checks every remote server in the official MCP registry each day, plus servers their owners add. A check sends only what every MCP client sends first: the handshake and a request for the tool list. It never calls a tool. This edition uses the newest daily check as of October 6, 2026: about 22,800 servers on the map, about 14,900 answered with a tool list.

How tools are counted

• Identical copies count once. A tool list copied onto many servers counts as one server, and a tool definition (name, description and labels) that appears on many servers counts as one tool. That leaves about 14,300 distinct servers and about 126,900 distinct tools, out of about 266,700 tools listed.
• Each tool is grouped by what its name and description say it does, using the same automated estimate that sets the risk levels on 7Maps. The tool's own labels are left out of this step, so a label can never move a tool into a safer group.
• "Marked destructive" means the server sets destructiveHint: true on the tool. "No annotations" means none of the four hints is present.
• Counts are rounded. Percentages are worked out before rounding and shown to one decimal place. Groups with too few tools to be meaningful show "too few to show".

Limits

• This is an estimate. The grouping reads names and descriptions, and a name can mislead: a tool called for running a report may only read, and a mild name can hide a risky action. Read the numbers as a fair picture of the whole, never as a verdict on any one server.
• Under the MCP specification a missing destructiveHint should be read as "may be destructive", so an unlabelled tool is not a false label. In practice many clients only act on labels that are present, which is why we count them.
• Servers that need sign-in before they list tools are not in the count. Neither are local servers that run on a user's own machine.

What we never publish

No server, tool, publisher or project is named, here or in the data files. We publish totals by group only, at the coarsest level that still answers the question.

Published October 6, 2026, the first edition. A new edition comes out early each month. License CC BY 4.0: use it with a link to this page.