Architecture Development Notes

Oct 27, 2026 · Backend Development

Why MCP's readOnlyHint Can't Be Trusted: Enforce Read-Only at the Database Layer

The article explains that MCP's readOnlyHint is a server-declared hint, not an enforceable guarantee; clients must treat annotations as untrusted unless from verified servers, and true read-only enforcement requires execution-layer permissions like database roles, while also noting data exfiltration risks via openWorldHint.