git404hub

what is mcphints fr?

kaihendry/mcphints — explained in plain English

Analysis updated 2026-05-18

2GoAudience · developerComplexity · 2/5LicenseSetup · easy

tl;dr

A small Go tool that shows which safety annotations an MCP server declares for its tools, so you can spot unverified claims before granting an AI agent access.

vibe map

mindmap
  root((mcphints))
    What it does
      Show declared tool hints
      Compare to spec defaults
      Flag unverified claims
    Tech stack
      Go
    Use cases
      Security review
      MCP server audit
    Audience
      Developers
      Security reviewers

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

what do people make with this?

VIBE 1

Check which safety annotations an MCP server actually declares before allowing an AI agent to use it.

VIBE 2

Compare a live MCP server's declared tool hints against the specification's conservative defaults.

VIBE 3

Paste raw tools/list JSON to audit tool annotations without connecting to a live server.

VIBE 4

Publish a security review of an MCP server's declared hints as a private GitHub gist.

what's the stack?

Go

how it stacks up fr

kaihendry/mcphintsanomalroil/1keyanshuman852/dasan-router-cli
Stars222
LanguageGoGoGo
Last pushed2019-05-17
MaintenanceDormant
Setup difficultyeasymoderatemoderate
Complexity2/53/53/5
Audiencedeveloperops devopsops devops

Figures from each repo's GitHub metadata at analysis time.

how do i run it?

Difficulty · easy time til it works · 5min
Free to use, modify, and distribute, including commercially, as long as you keep the copyright notice.

in plain english

MCP hints is a small tool for people who need to review the security of an MCP server, meaning a service that follows the Model Context Protocol used to give AI agents access to external tools. MCP servers can describe each of their tools with a set of labels called annotations, which state things like whether a tool only reads data, whether it can cause damage if misused, whether running it twice has the same effect as running it once, and whether it reaches out to the wider internet. This project checks which of those labels a given server actually declares, compared with what the official specification assumes by default when a label is left out. The tool makes an important point plain: these annotations are simply claims the server makes about itself, they are not checked or enforced by anything. So a tool could call itself safe without that claim ever being verified. Showing this gap clearly is the whole purpose of the project, so that someone deciding which AI agent actions to allow can see where they are relying on an unverified claim rather than a guarantee. To use it, you run the program with a single command and open it in your web browser. From there, you can either give it the web address of a live MCP server, or a command line instruction to start one, and it will fetch the list of tools for you, or you can paste the tool list data in directly if you already have it. The results of a check can also be published as a private note through GitHub's gist feature. The README is short and does not describe any other features beyond what is listed here. The project is released under the MIT license.

prompts (copy fr)

prompt 1
Run mcphints against this MCP server URL and tell me which tools are missing a destructiveHint.
prompt 2
Paste this tools/list JSON into mcphints and summarize which annotations are declared.
prompt 3
Explain what readOnlyHint and idempotentHint mean for MCP tool safety.
prompt 4
Help me decide which tools from this MCP server are safe to auto-approve based on mcphints output.

Frequently asked questions

what is mcphints fr?

A small Go tool that shows which safety annotations an MCP server declares for its tools, so you can spot unverified claims before granting an AI agent access.

What language is mcphints written in?

Mainly Go. The stack also includes Go.

What license does mcphints use?

Free to use, modify, and distribute, including commercially, as long as you keep the copyright notice.

How hard is mcphints to set up?

Setup difficulty is rated easy, with roughly 5min to a first successful run.

Who is mcphints for?

Mainly developer.

peek the repo → explain another one

This repo across BitVibe Labs

double-check against the repo, no cap.