An agent that catalogs MCP tools needs evidence of contradictory explicit read-only and destructive annotation declarations.