An MCP tool can carry readOnlyHint, destructiveHint, idempotentHint and openWorldHint. Read-only means the author thinks the call will not change outside state; destructive means it may delete data or spend money. A client can fold those tools or ask for a click, but that is not a hard permission.
Wrong labels are common. A query marked read-only can still write logs, bill an API or bust a cache. A destructive label does not mean every call wrecks production. Treat the hint as the author's note, then limit the account.
In a team config, leave destructive tools off by default and turn them on for one task. Read-only tools can stay in daily chat, but still check which paths or tenants they read. See approving MCP tool calls and MCP security basics on this site.
If you write a server, keep annotations matched to the implementation. A changed side effect with a stale hint makes the model pick the wrong tool. Review annotations next to the real effects in the PR.