Annotation flips on published MCP manifests
Re-derived 2026-10-16 from the fixture pairs dated 2026-10-10. The rows are hint declarations that changed between two published refs. Neon and Hugging Face are named because this is our reproduction of their published manifests.
What the fixtures are
Source file: test/fixtures/mcp-drift-2026-10-10/README.md in the app tree, read 2026-10-16. The note is dated 2026-10-10. Each directory holds before.json (ref B, the last commit before 2026-08-10) and after.json (ref A, the head on the measurement day).
| Server | Ref B | Ref A | How the manifest was produced |
|---|---|---|---|
| neondatabase/mcp-server-neon | 949281219441 (2026-08-03) |
185d5ee7a1ed (2026-10-04) |
Static, the repo's own Zod converter. Not a live tools/list. |
| huggingface/hf-mcp-server | 48811ec8bec6 (2026-08-07) |
dce2d5f0f163 (2026-10-05) |
Live tools/list, both refs. |
The same directory also holds firecrawl-mcp-server, next-devtools-mcp and playwright-mcp. The same analysis found no annotation flip on those three pairs.
The flips
The agent_tools analysis of the whole Neon pair decided BLOCK. The Hugging Face pair decided REQUIRE_APPROVAL. This table is only the annotation rows. The decision covers the rest of the pair as well.
| Tool | Hint | From | To | Direction | Severity |
|---|---|---|---|---|---|
explain_sql_statement |
destructiveHint |
false | true | riskier | HIGH |
explain_sql_statement |
idempotentHint |
true | false | riskier | HIGH |
explain_sql_statement |
readOnlyHint |
true | false | riskier | HIGH |
provision_neon_auth |
idempotentHint |
true | false | riskier | HIGH |
provision_neon_data_api |
idempotentHint |
true | false | riskier | HIGH |
hub_repo_details |
openWorldHint |
false | true | riskier | HIGH |
The rule
A riskier direction is a break. The published MCP schema defaults, read 2026-10-16 from ToolAnnotations, are: readOnlyHint false, destructiveHint true, idempotentHint false, openWorldHint true. Destructive and idempotent hints are meaningful only when readOnlyHint is false.
Does not prove
Does not prove: a hint is a declaration by the server, not measured behaviour. The flip proves the declaration changed. It does not prove that the tool became dangerous.