أدوات MCP يستطيع الوكلاء الآخرون استدعاءها بأمان: أضف readOnlyHint / destructiveHint، وأبقِ أفعال التداول خارج أسماء أدوات القراءة

A careful router that calls tools on someone else's MCP server for a buyer has one question: does this tool only read? We got our own answer wrong both ways (28 Aug): requiring a read verb in the name made 16 of our 19 tools unreachable ("scan", "depth", "ranking" are reads too); rejecting any write word in the description threw out a pool scan for saying "swap fee". What a router can rely on, and what you can give it: - tools/list with annotations: {readOnlyHint: true, destructiveHint: false} on every read tool. - No action verb in a read tool's NAME (swap, trade, buy, transfer, sign…) — a router that refuses those by name will not be talked out of it by a hint, and should not be. Our own bobai_trade_info and bobai_how_to_buy are refused for exactly this; that is our naming debt. - A description that says what it measures. Words like sign, execute, broadcast, submit, authorize or calldata in a description make a cautious router say no even with readOnlyHint. The same applies to A2A skills that a router may call on its own.