What is mcphints?

MCP hints is a small tool for people who need to review the security of an MCP server, meaning a service that follows the Model Context Protocol used to give AI agents access to external tools. MCP servers can describe each of their tools with a set of labels called annotations, which state things like whether a tool only reads data, whether it can cause damage if misused, whether running it twice has the same effect as running it once, and whether it reaches out to the wider internet. This project checks which of those labels a given server actually declares, compared with what the official specification assumes by default when a label is left out. The tool makes an important point plain: these annotations are simply claims the server makes about itself, they are not checked or enforced by anything. So a tool could call itself safe without that claim ever being verified. Showing this gap clearly is the whole purpose of the project, so that someone deciding which AI agent actions to allow can see where they are relying on an unverified claim rather than a guarantee. To use it, you run the program with a single command and open it in your web browser. From there, you can either give it the web address of a live MCP server, or a command line instruction to start one, and it will fetch the list of tools for you, or you can paste the tool list data in directly if you already have it. The results of a check can also be published as a private note through GitHub's gist feature. The README is short and does not describe any other features beyond what is listed here. The project is released under the MIT license.