Static inspection is valuable precisely when it is honest
A tools/list response shows the capability surface placed in model context: names, descriptions, input and output schemas, icons, annotations, and metadata. That is enough to detect broad execution tools, weak schemas, secret-like parameters, caller-selected destinations, confusable names, and instruction-like descriptions before a client connects.
It is not enough to call a server safe. The implementation may behave differently from its description, and the surrounding identity, policy, credential, network, and logging controls are outside the document.
Annotations are hints, not an authorization system
The MCP specification explicitly tells clients to treat tool annotations as untrusted unless they come from a trusted server. Read-only, destructive, idempotent, and open-world hints are useful review vocabulary, but they do not enforce the behavior they describe.
A risk report should therefore highlight missing or contradictory annotations while keeping runtime control coverage separate. A green readOnlyHint cannot replace a least-privilege credential, deterministic policy, or confirmation boundary.
- Use annotations to improve review and user experience.
- Cross-check claims against implementation and observed behavior.
- Grant authority from validated identity and policy—not metadata.
The most important result may be not observable
Authentication, tenant derivation, authorization, approval enforcement, audit completeness, outbound network controls, and outcome verification cannot be proved from a pasted tool list. Marking those controls not observable is more useful than quietly awarding points for evidence that was never supplied.
That distinction also creates the bridge to a production gateway. The same review findings can become release gates, while the runtime supplies independent evidence for the controls static inspection cannot see.
From assessment to enforced access
A production record connects the authenticated organization, principal, and client to an immutable assessed release, deterministic policy decision, credential reference, sanitized dispatch, validated response, and linked audit events. Those records answer a different question from static analysis: not only what a server advertised, but what authority the gateway exercised.
That is the current null.select product boundary: assess the advertised surface for free, expose only a curated read-only tool through the managed gateway, and preserve verifiable evidence without logging secrets or raw upstream payloads.