failClosedToolAnnotations

const failClosedToolAnnotations: EffectiveToolAnnotationSource

Defined in: _worktrees/docs-release/gaunt-sloth/packages/core/src/core/approvals/matcher.ts:157

The EffectiveToolAnnotationSource a caller gets when it wires none: every tool reads as MCP_FAIL_CLOSED_ANNOTATIONS.

It is the safe default and not a stub — it is what a fully distrustful configuration computes anyway (§4.7.1: an untrusted server’s effective set IS this constant), so a call site that has no annotations to offer behaves exactly like one whose user believes nothing. Deliberately NOT a trust model: trust needs config, and config belongs to core/approvals/annotations.ts.

It answers with a fresh object per call, matching createEffectiveToolAnnotationSource, so the whole contract — not merely its configured half — is safe to snapshot.