Protect Destructive MCP Tools

Destructive tools deserve explicit design rather than relying on a model to “be careful.”

Separate them from reads

Use distinct tool names so clients can hide or require approval for mutations.

Prefer reversible actions

Archive instead of permanently delete when the domain allows it. Use staging before production. Offer dry-run previews for bulk changes.

Require exact targets

A mutation should identify what will change. Avoid broad wildcard defaults.

Use idempotency

Network retries should not create duplicate payments, messages, or deployments.