Repository navigation
Add MCP readOnlyHint annotations to tools - #1124
Merged
1 commit merged intoNov 6, 2026
Merged
1 commit merged into
1 commit merged into
Conversation
Every @mcp.tool() was registered with no annotations, so MCP clients could not tell read-only query tools from writers. Declare readOnlyHint on all 30 tools: apply_refactor_tool is destructive, the four graph writers are non-destructive and idempotent, and the rest are read-only. Fixes tirth8205#1123 Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com> Signed-off-by: jay23606 <4602056+jay23606@users.noreply.github.com>
code-review-graph reviewOverall risk: 0.35 (LOW) — 4 changed function(s)/class(es), 37 affected flow(s), 0 test gap(s) Risk-scored changes
Affected execution flows
Powered by code-review-graph — local-first analysis; no code leaves the CI runner. |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Tool safety hints mislabel queries that can create or migrate databases as read-only, destructive operations as additive-only, and identity-changing post-processing as idempotent.
3 open issues
What changed in this PR
Adds MCP tool annotations to help clients distinguish queries from writes, addressing unnecessary permission prompts in plan/read-only modes described in #1123.
Changes:
- Adds read-only, destructive, and idempotent hints across all 30 tool registrations.
- Adds FastMCP API tests for annotation presence and read/write classifications.
- Leaves tool implementations unchanged.
| File | Description |
|---|---|
tests/test_tool_annotations.py |
Tests registered tools’ read-only and destructive hints. |
code_review_graph/main.py |
Adds annotations to every MCP tool decorator. |
Review effort: Balanced
|
|
||
|
|
||
| @mcp.tool() | ||
| @mcp.tool(annotations={"readOnlyHint": True}) |
|
|
||
|
|
||
| @mcp.tool() | ||
| @mcp.tool(annotations={"readOnlyHint": False, "destructiveHint": False, "idempotentHint": True}) |
|
|
||
|
|
||
| @mcp.tool() | ||
| @mcp.tool(annotations={"readOnlyHint": False, "destructiveHint": False, "idempotentHint": True}) |
tirth8205
closed this pull request by merging all changes
into
tirth8205:staging
in
0160eb0
gowrishacv
pushed a commit
to gowrishacv/code-review-graph
that referenced
this pull request
Nov 6, 2026
tirth8205#1124) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
gowrishacv
pushed a commit
to gowrishacv/code-review-graph
that referenced
this pull request
Nov 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1123
Change
Every
@mcp.tool()incode_review_graph/main.pyis now registered withannotations:apply_refactor_tool:readOnlyHint: False,destructiveHint: True(writes source files).build_or_update_graph_tool,run_postprocess_tool,embed_graph_tool,generate_wiki_tool:readOnlyHint: False,destructiveHint: False,idempotentHint: True(write only the graph's own data).readOnlyHint: True.The classification follows the one proposed in the issue. No tool behaviour changes.
New test:
tests/test_tool_annotations.pylists the tools over the FastMCP API and checks the hints above.Tests
Before (
uv run --python 3.13 python -m pytest tests/test_tool_annotations.py -q): 3 failed. No tool declares annotations (AttributeError: 'NoneType' object has no attribute 'readOnlyHint').After (same command plus
tests/test_public_tool_hints.py, which parses the same decorators): 4 passed.Not run: the full suite and the
surface-marked MCP tests.