Add ToolAnnotations to all 11 MCP tools (title, readOnlyHint, destructiveHint, idempotentHint)

[Copilot]

MCP SDK 1.0's ToolAnnotations support (readOnlyHint, destructiveHint, idempotentHint, title) was unused. These hints enable AI clients to auto-approve safe operations, show confirmation UI for destructive ones, and display human-readable titles.

Changes

Annotations via native McpServerToolAttribute properties

Uses Title, ReadOnly, Destructive, and Idempotent on [McpServerTool] — the native approach that maps directly to the MCP protocol's ToolAnnotations struct.

// Read-only info tools
[McpServerTool(Title = ".NET CLI Help", ReadOnly = true, Idempotent = true, IconSource = "...")]

// Destructive tools (most-permissive-action wins)
[McpServerTool(Title = ".NET Project", Destructive = true, IconSource = "...")]

Annotation mapping (most-permissive-action strategy for consolidated tools)

Tool	Title	ReadOnly	Destructive	Idempotent
DotnetProject	".NET Project"		✅
DotnetPackage	"NuGet Package Manager"		✅
DotnetSolution	".NET Solution Manager"		✅
DotnetSdk	".NET SDK & Templates"
DotnetTool	".NET Tool Manager"		✅
DotnetWorkload	".NET Workload Manager"		✅
DotnetDevCerts	"Dev Certs & User Secrets"		✅
DotnetEf	"Entity Framework Core"		✅
DotnetHelp	".NET CLI Help"	✅		✅
DotnetServerCapabilities	"Server Capabilities"	✅		✅
DotnetServerInfo	"Server Information"	✅		✅

Tests

• ToolMetadataSerializationTests — 3 new reflection tests verifying Title, ReadOnly/Idempotent, and Destructive on all annotated methods
• McpConformanceTests — 3 new integration tests verifying ReadOnlyHint, DestructiveHint, and Title appear correctly in the tools/list protocol response

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Add ToolAnnotations to all MCP tools (readOnlyHint, destructiveHint, idempotentHint)</issue_title>
<issue_description># Overview

Add ToolAnnotations to all 11 MCP tools, providing semantic hints that help AI assistants understand tool behavior and make better decisions about when/how to invoke them.

MCP SDK Feature: Introduced in v0.9.0-preview.1 (PR jongalloway/dotnet-mcp#1168)

Background

MCP SDK 1.0 supports ToolAnnotations on tool definitions with the following hints:

• readOnlyHint (bool) — Tool only reads data, no side effects
• destructiveHint (bool) — Tool may perform destructive/irreversible operations
• idempotentHint (bool) — Repeated calls with same args produce same result
• openWorldHint (bool) — Tool interacts with external entities beyond its data source
• title (string) — Human-readable display title

These annotations help AI clients:

• Auto-approve read-only operations
• Show confirmation UI for destructive operations
• Optimize retry/caching strategies for idempotent tools
• Communicate tool purpose clearly to users

Implementation Plan

Tool Annotation Mapping

Tool	readOnly	destructive	idempotent	Notes
DotnetSdk (List/Help/Version)	✅	❌	✅	Pure info queries
DotnetProject — Build	❌	❌	✅	Creates artifacts but repeatable
DotnetProject — New	❌	❌	❌	Creates files on disk
DotnetProject — Run	❌	❌	❌	Starts processes, side effects
DotnetProject — Test	❌	❌	✅	Tests are idempotent
DotnetProject — Clean	❌	✅	✅	Deletes build artifacts
DotnetProject — Publish	❌	❌	✅	Creates output but repeatable
DotnetPackage — Add	❌	❌	✅	Modifies project file
DotnetPackage — Remove	❌	✅	✅	Removes from project
DotnetPackage — List	✅	❌	✅	Read-only query
DotnetSolution	varies	varies	varies	Depends on action
DotnetTool	varies	varies	varies	Install/uninstall vs list
DotnetWorkload	varies	varies	varies	Install vs list
DotnetDevCerts	❌	varies	varies	Trust/clean are destructive
DotnetEntityFramework	varies	varies	varies	Migration add vs list
DotnetHelp	✅	❌	✅	Pure info

Implementation Options

Option A: [McpMeta] attributes (simpler, available today)

[McpMeta("readOnlyHint", true)]
[McpMeta("idempotentHint", true)]

Option B: Native ToolAnnotations property (if SDK 1.0 exposes it on [McpServerTool])

• Preferred if the source generator supports it directly

Per-action annotations

For consolidated tools with action parameters (e.g., DotnetProject handles Build, Run, Test, Clean), annotations should reflect the most permissive action (i.e., if any action is destructive, the tool should be marked destructive). Document per-action differences in the tool description.

Tasks

• Determine annotation mechanism (McpMeta vs native ToolAnnotations)
• Add annotations to all 11 tool methods
• Add title annotations with human-friendly names
• Update tests to verify annotations are present in tool listings
• Document annotation strategy in copilot-instructions.md

Acceptance Criteria

• All 11 tools have appropriate readOnlyHint, destructiveHint, idempotentHint annotations
• MCP conformance tests verify annotations appear in tools/list response
• AI assistants can differentiate read-only from destructive tools

Dependencies

• Blocked on Upgrade to MCP C# SDK v1.0.0 (from v0.6.0-preview.1) #350 (Upgrade to MCP SDK 1.0)
  </issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Add ToolAnnotations to all MCP tools (readOnlyHint, destructiveHint, idempotentHint) #351

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

This PR adds MCP SDK 1.0 ToolAnnotations (Title, ReadOnly, Destructive, Idempotent) to all 11 MCP tools, enabling AI assistants to make better decisions about when to auto-approve operations, when to show confirmation prompts, and how to display tools to users. The implementation uses native McpServerToolAttribute properties and follows a "most-permissive-action" strategy for consolidated tools.

Changes:

• Added Title property to all 11 MCP tool attributes with human-readable display names
• Marked 3 info/query tools (DotnetHelp, DotnetServerCapabilities, DotnetServerInfo) as ReadOnly = true, Idempotent = true
• Marked 7 tools with destructive actions as Destructive = true (Project, Package, Solution, Tool, Workload, DevCerts, EntityFramework)
• Added 6 new tests (3 reflection-based, 3 protocol-based) to verify annotations are correctly set and appear in MCP protocol responses

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
DotNetMcp/Tools/Sdk/DotNetCliTools.Sdk.Consolidated.cs	Added Title ".NET SDK & Templates" (no ReadOnly/Destructive - template management is non-destructive)
DotNetMcp/Tools/Cli/DotNetCliTools.Workload.Consolidated.cs	Added Title and Destructive=true (Uninstall action)
DotNetMcp/Tools/Cli/DotNetCliTools.Tool.Consolidated.cs	Added Title and Destructive=true (Uninstall action)
DotNetMcp/Tools/Cli/DotNetCliTools.Solution.cs	Added Title and Destructive=true (Remove action)
DotNetMcp/Tools/Cli/DotNetCliTools.Project.Consolidated.cs	Added Title and Destructive=true (Clean action)
DotNetMcp/Tools/Cli/DotNetCliTools.Package.Consolidated.cs	Added Title and Destructive=true (Remove/ClearCache actions)
DotNetMcp/Tools/Cli/DotNetCliTools.Misc.cs	Added Title, ReadOnly, and Idempotent to 3 info/query tools
DotNetMcp/Tools/Cli/DotNetCliTools.EntityFramework.Consolidated.cs	Added Title and Destructive=true (DatabaseDrop/MigrationsRemove actions)
DotNetMcp/Tools/Cli/DotNetCliTools.DevCerts.Consolidated.cs	Added Title and Destructive=true (CertificateClean/SecretsClear actions)
DotNetMcp.Tests/Tools/ToolMetadataSerializationTests.cs	Added 3 reflection tests verifying Title, ReadOnly/Idempotent, and Destructive annotations
DotNetMcp.Tests/Server/McpConformanceTests.cs	Added 3 integration tests verifying annotations appear in MCP protocol's tools/list response