MCP tools include write/destructive/external-side-effect risk classes
TOOL-RISK-001 · v1.0
What it detects
One or more of this site's exposed MCP tools classify — by a NAME-BASED GUESS over the tool's name/description, not by inspecting its actual behavior — as WRITE, DESTRUCTIVE, or EXTERNAL_SIDE_EFFECT rather than READ_ONLY/UNKNOWN.
Why it matters
An informational risk hint, not a graded defect: it helps an operator or agent gauge how cautiously to invoke a tool by its naming convention, but a name is not proof of what a tool actually does.
How to fix
- This is informational — no remediation is required. It's a naming-convention risk hint (a guess, not a graded defect), surfaced so an operator or agent can gauge how cautiously to invoke a flagged tool. - If a tool's flagged risk class looks wrong for what it actually does, consider renaming it to a conventional verb prefix (get_/list_/search_/read_/fetch_/query_/describe_ for reads; create_/update_/set_/post_/put_/add_/write_ for writes; delete_/remove_/drop_/refund_/cancel_/revoke_ for destructive actions; send_/email/sms/payment/charge/notify/publish for external side effects) so its name accurately signals risk to anyone reading `tools/list`. - Verify: re-fetch `tools/list` and confirm each tool's name reflects what it actually does.
References
Last reviewed: 2026-09-01 · rule v1.0