trustedAnnotationHints
trustedAnnotationHints(
mcp,server): readonly ("readOnlyHint"|"destructiveHint"|"idempotentHint"|"openWorldHint")[]
Defined in: _worktrees/docs-release/gaunt-sloth/packages/core/src/core/approvals/annotations.ts:126
§4.7.1/§9 — the hints the user believes from ONE server, by the user’s own config key.
defaults applies to servers not named under servers. A server that names itself states
its relationship in full, so {"jira": {}} trusts nothing however permissive defaults is.
The alternative — falling back to defaults field by field — would mean a server named with an
empty body silently inherits trust, and trust by omission is the failure this section exists to
prevent.
The lookup is an own-property one, and that is load-bearing rather than defensive noise.
servers is a plain user-authored map, so a server key that collides with an Object.prototype
member (constructor, toString, hasOwnProperty, valueOf) would otherwise resolve to the
INHERITED value — truthy, so defaults is never consulted and that one server silently gets a
relationship nobody wrote. Here that lands fail-closed; on the expose field [[EXT-73]] adds to
this same block it lands fail-OPEN, because an absent expose means “expose every tool”. A
server’s identity is the user’s own config key (§4.7.5) and every such key must resolve by the
same rule.
UNRESOLVED_MCP_SERVER trusts nothing, whatever defaults says. A call whose server
could not be resolved has no identity, so there is no relationship for it to inherit: it is not
a server the user declined to name, it is a server nobody can name. Because the sentinel is
z.string().min(1)-unspellable it can never appear under servers, so without this it would
fall through to defaults and a permissive default would hand an unattributable tool the
trust its user granted to real, identified ones — believing a tool that claims to be harmless
precisely where we cannot say whose claim it is. The guard belongs here, where §4.7.5’s “no
trust can be granted to it” is asserted, rather than only in whichever lookup happens to run
next.
Parameters
Section titled “Parameters”McpApprovalsConfig | undefined
server
Section titled “server”string
Returns
Section titled “Returns”readonly ("readOnlyHint" | "destructiveHint" | "idempotentHint" | "openWorldHint")[]