Abstract

Proposes the addition of a new trusted tool annotation to the Model Context Protocol (MCP) specification. This hint explicitly marks whether a tool can be considered trusted. By default, tools should be considered trusted: false unless explicitly marked otherwise. The existing openWorld annotation is not sufficient to communicate trust status for all tools.

Summary

This SEP proposes a new trusted annotation for tools in the MCP specification. The default for all tools should be trusted: false, unless explicitly marked as trusted. This provides a clear, consistent way to communicate the trust status of a tool, which is not adequately covered by the existing openWorld annotation.

Motivation

The MCP specification currently lacks a clear way to indicate whether a tool is trusted. The openWorld annotation only covers tools that interact with external or untrusted data sources, but does not provide a general mechanism for marking trust status. This can lead to confusion and potential security risks, as users and implementers may assume tools are trusted by default. Explicitly marking tools as trusted or untrusted will improve clarity and security.

Proposal

• Add a new trustedHint annotation for tools in the MCP specification's ToolAnnotations interface:

  interface ToolAnnotations {
  	destructiveHint?: boolean
  	idempotentHint?: boolean
  	openWorldHint?: boolean
  	readOnlyHint?: boolean
  	title?: string
  	trustedHint?: boolean // NEW: Indicates whether the tool is considered safe and reliable
  }

• All tools should default to trustedHint: false unless explicitly marked as trusted.

• The trustedHint annotation should be used to indicate that a tool is safe, reliable, and does not expose users to untrusted or potentially harmful data or operations.

• Existing hints (such as openWorldHint, destructiveHint, etc.) describe tool behavior, but do not communicate whether a tool is considered safe or trustworthy. For example, openWorldHint: false does not mean the tool is trusted.

Rationale

Explicitly marking tools as trusted or untrusted improves security and clarity for users and implementers. It prevents assumptions about tool safety and ensures that only tools which have been reviewed and verified are marked as trusted. This is especially important for tools that interact with sensitive data or perform critical operations.

The current ToolAnnotations hints are not guaranteed to provide a faithful description of tool behavior, and clients should never make tool use decisions based on ToolAnnotations received from untrusted servers. The trusted hint is intended to provide a clear, explicit signal for trust, but it should still be treated as a hint and not a guarantee.

Backwards Compatibility

This SEP does not introduce breaking changes. The trusted annotation is additive and does not affect existing tools unless they are updated to use the new hint.

Implementation

Update the MCP specification documentation to:

• Add the trusted annotation for tools.
• Specify that tools should default to trusted: false.
• Provide guidance and examples for when to mark a tool as trusted.

Discussion

• The community has identified the need for a clear, general-purpose trust annotation for tools.
• This SEP addresses gaps not covered by the existing openWorld annotation.