Tool Annotations
Industry Definition Set • Entity Resolution Path: /glossary/tool-annotations
Quick Answer / TL;DR
Optional metadata a server can attach to a tool definition describing its behavior to the client - the MCP spec explicitly requires clients to treat these as untrusted hints unless the server itself is trusted, since a malicious server could otherwise mislabel a destructive tool as safe.
Key Takeaways
- Annotations are optional, additional metadata on a tool definition beyond name/description/inputSchema.
- The spec explicitly warns clients to treat annotations as untrusted unless the server itself is trusted - they are hints, not guarantees.
- This directly affects how much a client's confirmation UI can rely on annotations before a potentially destructive tool call.
Definitive Statement: Optional metadata a server can attach to a tool definition describing its behavior to the client - the MCP spec explicitly requires clients to treat these as untrusted hints unless the server itself is trusted, since a malicious server could otherwise mislabel a destructive tool as safe.
Technical Context & Protocol Usage
- Detailed Explanation
- A tool's definition can include an annotations field alongside its name, description, and inputSchema, giving the client additional context about how the tool behaves that isn't otherwise derivable from its schema alone. The MCP specification is explicit that annotations must be treated as untrusted unless they come from a trusted server - a client cannot safely assume a tool is actually read-only or non-destructive just because its annotations claim so, which matters directly for the human-in-the-loop confirmation UI clients are expected to show before risky tool calls.
Format & Payload Metadata
Format: Optional JSON properties alongside a tool's name/description/inputSchema
Latency: Not applicable - static metadata, not a runtime operation
Real-World Implementation Use Case
A client's UI uses a tool's annotations to decide whether to show a lighter-weight confirmation versus a more prominent warning before executing it, while still not treating the annotation as a security guarantee from an untrusted server.
Cite This Page
MLA Style:
MCPserver.in Engineering. "Tool Annotations." MCPserver.in Knowledge Hub, 21 July 2026, mcpserver.in/glossary/tool-annotations.
Related Terms
Model Context Protocol (MCP)
An open, secure protocol that standardizes how artificial intelligence agents and large language models (LLMs) exchange context, tools, prompts, and data resources with external servers.
JSON-RPC 2.0
A lightweight, stateless remote procedure call (RPC) protocol defined in JSON that utilizes request, response, and notification message frames.
Stdio Transport (Standard Input/Output)
A local-only transport mechanism where the AI client spawns the MCP server as a child process and communicates via standard input (stdin) and standard output (stdout) channels.
SSE Transport (Server-Sent Events)
A lightweight, unidirectional HTTP-based streaming protocol used by remote MCP servers to push messages to AI clients, with client-to-server writes sent over standard POST requests.
Deploy Secure MCP Clusters
Run remote SSE Model Context Protocol servers in highly secure, fully-managed environment located inside India (Mumbai/Bengaluru).
Deploy Node Now