MCP Protocol Security: Why the readOnlyHint Vulnerability Exposes a Fundamental Flaw in AI Agent Tool Calls

Short summary

The Model Context Protocol (MCP) contains a fundamental security flaw: its readOnlyHint field is entirely unenforced, allowing any server to declare destructive tools as read-only without verification. An ecosystem-wide audit across 8 major frameworks found zero frameworks validate tool declarations against actual behavior, making the entire MCP tool classification model honor-system-only. The vulnerability compounds with the STDIO transport pattern, enabling a full attack chain where malicious MCP servers execute arbitrary OS commands through trusted read-only tool calls.

• •readOnlyHint in MCP is unenforced — any server can mark destructive tools as read-only
• •Audit of 8 major frameworks found zero validate tool declarations against actual behavior
• •STDIO transport compounds the flaw, enabling arbitrary OS command execution via trusted tool calls

Generated with AI, which can make mistakes.