Symptom
On an MCP server set to trust: untrusted, even tools marked readOnlyHint: true wait for approval, and in non-interactive runs they are refused.
Evidence what you'll see
- Every tool from the untrusted server is treated as write-capable
- Tools that declare readOnlyHint: true still ask for approval
- Non-interactive runs (hermes -z, the API server) refuse the call
Cause
With mcp 2.0.0 the annotation field is named read_only_hint, and the trust gate only looked for readOnlyHint, so it never saw the hint.
Fix steps
0 of 1 done
Your check marks stay in this browser only.
Verify the fix worked
- Call a read-only tool on the untrusted server and confirm it runs without an approval prompt.
Sources and credit
Summarized in our own words from these public reports. Credit goes to their authors.
Provided as is, without warranty. Try changes in a non-production environment and back up first. Security-related steps: verify against the official docs. Terms · Request removal or attribution change
Hit an error we don't cover? Submit it