Non-destructive write tools omit `destructiveHint: false`, causing conservative approval prompts

Bắt đầu bằng cách xác định các đăng ký của create_branch và create_pull_request, sau đó so sánh ToolAnnotations của chúng với create_pull_request_review và delete_file. Kiểm tra các công cụ ghi khác được đề cập trong issue, đánh dấu rõ ràng các thao tác mang tính bổ sung là không gây phá hủy, đồng thời xử lý thận trọng hành vi ghi đè hoặc xóa. Hoàn thành khi các annotation liên quan đã được phân loại và các bài kiểm thử công cụ hiện có đều chạy đạt.

Describe the bug

Some clearly non-destructive/additive GitHub MCP tools set ReadOnlyHint: false but omit DestructiveHint: false.

Under the MCP ToolAnnotations contract, destructiveHint defaults to true when omitted for a non-read-only tool. Clients that honor the conservative default can therefore treat routine additive operations as potentially destructive and require additional confirmation.

This is observable with ChatGPT using the official github-mcp-server over Streamable HTTP / Secure MCP Tunnel: read tools execute automatically when the app is configured with elevated / "Allow all actions" permissions, while routine write tools such as creating a branch or opening a pull request still trigger confirmation.

On desktop, the user can approve for the conversation. On mobile, the same workflow can require repeated per-call approvals.

Examples in the current server

create_branch currently advertises:

Annotations: &mcp.ToolAnnotations{
    Title:        t("TOOL_CREATE_BRANCH_USER_TITLE", "Create branch"),
    ReadOnlyHint: false,
},

create_pull_request currently advertises:

Annotations: &mcp.ToolAnnotations{
    Title:        t("TOOL_CREATE_PULL_REQUEST_USER_TITLE", "Open new pull request"),
    ReadOnlyHint: false,
},

Both operations are additive and appear to be good candidates for an explicit:

DestructiveHint: jsonschema.Ptr(false),

There is already precedent in the codebase: create_pull_request_review explicitly sets DestructiveHint: false, while genuinely destructive tools such as delete_file explicitly set DestructiveHint: true.

Expected behavior

Clearly additive write tools should explicitly advertise DestructiveHint: false instead of inheriting the MCP default of true.

It may also be worth auditing other write tools and explicitly classifying them rather than relying on the default. Tools whose behavior depends on the requested method or which can overwrite/delete existing state should remain conservative.

Why this matters

This does not change security enforcement; MCP annotations are hints. But clients use those hints to drive confirmation UX.

Missing destructiveHint: false makes safe additive operations indistinguishable from potentially destructive writes to conservative clients, which creates significant approval friction in agentic workflows.

Environment

• github-mcp-server v1.12.1
• Streamable HTTP transport
• ChatGPT custom MCP app over OpenAI Secure MCP Tunnel
• App permission set to elevated / Allow all actions
• Read operations do not prompt; routine write operations do

Related issues

• #798 — fine-grained confirmation settings for write actions
• #2723 — label_write delete missing DestructiveHint: true