Add tool annotations to remaining MCP tools

Adds title and behavior hints (readOnlyHint, destructiveHint,
idempotentHint, openWorldHint) to the 12 tools that were missing them,
matching the pattern already used by the credential and API-key tools.
All tools now declare annotations, which MCP clients use to label tools
and gate destructive actions.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: AnnaXWang

src/lib/mcp/tools/apps.ts

@@ -102,6 +102,13 @@ export function registerAppCapabilities(server: McpServer) {
         .describe("(list_apps, list_deployments) Pagination offset. Default 0.")
         .optional(),
     },
+    {
+      title: "Manage Kernel apps and invocations",
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: true,
+    },
     async (params, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);

src/lib/mcp/tools/browser-curl.ts

@@ -41,6 +41,13 @@ export function registerBrowserCurlTool(server: McpServer) {
         .describe("Request timeout in milliseconds.")
         .optional(),
     },
+    {
+      title: "Send HTTP request via browser",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: true,
+    },
     async (params, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);

src/lib/mcp/tools/browser-pools.ts

@@ -115,6 +115,13 @@ export function registerBrowserPoolCapabilities(server: McpServer) {
         .describe("(release) Reuse browser instance or recreate. Default true.")
         .optional(),
     },
+    {
+      title: "Manage Kernel browser pools",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: false,
+    },
     async (params, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);

src/lib/mcp/tools/browsers.ts

@@ -356,6 +356,13 @@ export function registerBrowserCapabilities(server: McpServer) {
         )
         .optional(),
     },
+    {
+      title: "Manage Kernel browser sessions",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: false,
+    },
     async (params, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);

src/lib/mcp/tools/computer-action.ts

@@ -254,6 +254,13 @@ export function registerComputerActionTool(server: McpServer) {
           "Ordered list of actions. Use one action for simple operations or multiple for batched sequences.",
         ),
     },
+    {
+      title: "Control browser (mouse, keyboard, screenshot)",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: true,
+    },
     async ({ session_id, actions }, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);

src/lib/mcp/tools/docs.ts

@@ -19,6 +19,13 @@ export function registerDocsTools(server: McpServer) {
           'Natural language search query (e.g., "how to deploy an app", "browser automation examples").',
         ),
     },
+    {
+      title: "Search Kernel documentation",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false,
+    },
     async ({ query }, extra) => {
       if (
         !process.env.MINTLIFY_ASSISTANT_API_TOKEN ||

src/lib/mcp/tools/extensions.ts

@@ -14,6 +14,13 @@ export function registerExtensionTools(server: McpServer) {
         .describe("(delete) Extension ID or name to delete.")
         .optional(),
     },
+    {
+      title: "Manage Kernel browser extensions",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: false,
+    },
     async (params, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);

src/lib/mcp/tools/playwright.ts

@@ -20,6 +20,13 @@ export function registerPlaywrightTool(server: McpServer) {
         )
         .optional(),
     },
+    {
+      title: "Execute Playwright code",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: true,
+    },
     async ({ code, session_id }, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);

src/lib/mcp/tools/profiles.ts

@@ -79,6 +79,13 @@ export function registerProfileCapabilities(server: McpServer) {
         .describe("(setup) If true, update existing profile. Default false.")
         .optional(),
     },
+    {
+      title: "Manage Kernel browser profiles",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: true,
+    },
     async (params, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);

src/lib/mcp/tools/projects.ts

@@ -36,6 +36,13 @@ export function registerProjectCapabilities(server: McpServer) {
         .optional(),
       ...paginationParams,
     },
+    {
+      title: "Manage Kernel projects",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: false,
+    },
     async (params, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);