[rajanaggarwal11]

What

Every tool now carries MCP tool annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint), passed through in tools/list.

Tool	readOnlyHint	Why
nextjs_docs	true	reads the installed next package and its bundled docs
nextjs_index	true	discovery: probes local dev servers and lists their tools
browser_eval	true	despite the name, it only runs command -v agent-browser / --version and returns instructions — it never drives a browser
nextjs_call	false, destructiveHint: true	a proxy for whatever tool the dev server exposes; it cannot honestly claim less

Why

Without hints a client has to treat all four tools the same. Clients use readOnlyHint to decide whether to ask the human before a call, so today nextjs_docs gets the same treatment as nextjs_call — or, if a client is lenient, nextjs_call gets the same treatment as nextjs_docs. browser_eval is the interesting one: from the name alone a client (or a linter) assumes it evaluates something, and the hint is the only way to say it doesn't.

Found while running mcpcheck over the most-downloaded MCP servers on npm. Before:

 warn  missing-annotations
  ! browser_eval — declares neither readOnlyHint nor destructiveHint
  ! nextjs_call — declares neither readOnlyHint nor destructiveHint
  ! nextjs_docs — declares neither readOnlyHint nor destructiveHint
  ! nextjs_index — declares neither readOnlyHint nor destructiveHint

After:

mcpcheck · next-devtools-mcp 0.4.0 · 4 tools · node dist/index.js

✓ No problems found across 4 tools.

Tests

• test/e2e/mcp-registration.test.ts asserts each tool's readOnlyHint and that every tool declares destructiveHint.
• pnpm build && pnpm test && pnpm test:e2e pass locally (Node 24).
• Changeset: patch.