OpenAI's MCP Review Rules: Every Tool Needs Annotations, but Hints Aren't Security
shoumikgoswami · reddit · 2026-10-31
InfoQ reported OpenAI engineer Thomas Sarlandie's talk at AGNTCon/MCPCon: ChatGPT's plugin directory rejects MCP servers unless every tool carries annotations, enabling fast-track of read-only calls and confirmation of destructive ones.
Key criteria:
- readOnlyHint: true only if the tool cannot change state — sending messages, running jobs, writing logs, or starting workflows all disqualify it.
- destructiveHint: true whenever results can be irreversible, even via select modes, default parameters, or indirect side effects.
- openWorldHint: true for anything reaching the public internet or open-ended external entities, including read-only web search; false for bounded private accounts/workspaces.
A subtle rule: justification text in submissions can't override annotations. If the server advertises readOnlyHint: false, calling it "functionally read-only" in the form changes nothing — fix the annotation, deploy, rescan, verify.
The other half: the MCP spec requires clients to treat annotations as untrusted, and OpenAI's docs stress they don't replace server-side authorization, input validation, or confirmation for consequential actions. Accurate hints help clients decide when to ask — they enforce nothing.
More from coding & agent
- Team runs Devin inside Slack and Linear as an autonomous project manager for mobile dev work — tomchapin · 2026-10-31
- OpenReceive ships open-source Laravel package for self-hosted Bitcoin and stablecoin checkout — Aiden_Tech_Ai · 2026-10-31
- Cloudflare Durable Objects No Longer Interrupted by Deploys, Update on Hibernate — threepointone · 2026-10-31
- KRC NodePack: open-source ComfyUI nodes for local model, LoRA and prompt cataloging — riceandnori · 2026-10-31
- Matt Shumer: harness engineering is usually stupid — use the harness the model was trained for — mattshumer_ · 2026-10-31
- Proof of Agent lets AI agents verify each other in a token-mining experiment — adamamcbride · 2026-10-31