WebMCP tool safety annotations contradict themselves

What it detects

A WebMCP tool declares safety hints that contradict each other or the tool's own name — for example readOnlyHint together with destructiveHint, or a read-only claim on a tool named as a delete operation.

Why it matters

Agents use these hints to decide what they may call without asking a user first, so a self-contradicting declaration leaves no safe interpretation. Only hints a page actually declares are considered — declaring nothing is never a finding.

How to fix

- Review the flagged tools (in the finding's `examples`) and make each tool's annotations describe what it actually does: `readOnlyHint: true` only where the tool cannot change any state, `destructiveHint: true` where its effect is irreversible. - Never set `readOnlyHint` and `destructiveHint` true on the same tool — an agent has no way to resolve that, and the safe reading (assume destructive) discards the benefit of annotating at all. - If a tool declared read-only is named like a mutation (`delete_`, `remove_`, `cancel_`), rename the tool or correct the hint: an agent reads the name alongside the annotation. - Verify: re-run the scan and confirm no WebMCP tool reports an annotation conflict.

References

• Model Context Protocol specification
• WAI-ARIA 1.2 (W3C)