feat(filesystem): add idempotentHint and openWorldHint annotations

[ykshah1309]

Summary

Adds idempotentHint and openWorldHint to tool annotations in server-filesystem, completing the annotation coverage for all four standard MCP hints.

Closes #3402

Changes

• Add idempotentHint: true to 10 read-only tools — reads are inherently safe to retry and produce identical results
• Add openWorldHint: false to all 14 tools — every operation is scoped to allowed directories with no network access or external side effects

Testing

Metadata-only change with no behavioral impact.

• npm run build --workspace=src/filesystem compiles cleanly
• npm test --workspace=src/filesystem — all 146 tests pass

[cliffhall]

@claude review

[claude]

Claude finished @cliffhall's task in 1m 31s —— View job

---

PR Review

• Read the changed file and git diff
• Check MCP spec compliance for annotation values
• Verify annotation assignments match tool semantics
• Post review feedback

---

Overall: Clean, correct, and spec-compliant. This PR completes annotation coverage for the filesystem server with well-reasoned values.

openWorldHint: false — All 14 tools

Correct across the board. Every tool in this server operates exclusively on the local filesystem within allowed directories — no network calls, no external services. The MCP spec default is true (open world assumed), so explicitly declaring false is a meaningful and accurate signal to clients.

idempotentHint: true — 10 read-only tools

Correct. None of these reads mutate environment state, so calling them repeatedly with the same arguments has no additional effect.

One minor note: the MCP spec states that readOnlyHint: true implies idempotentHint: true, making the explicit setting technically redundant. However, being explicit is a defensible style choice — it makes the intent unambiguous and doesn't violate the spec. No action required.

Pre-existing write-tool annotations (unchanged by this PR, but worth validating)

Tool	idempotentHint	destructiveHint	Assessment
write_file	true	true	✓ Overwrites idempotently; destructive because prior content is lost
edit_file	false	true	✓ Applying the same edit twice yields different results
create_directory	true	false	✓ mkdir -p is idempotent; no destruction
move_file	false	true	✓ Second call with same args fails (destination exists); not idempotent

All pre-existing values hold up under scrutiny.

Suggestion: list_allowed_directories and dynamic Roots

list_allowed_directories returns the server's current allowed directories, which can change at runtime via MCP Roots updates. This doesn't affect the correctness of idempotentHint: true (the hint is about side effects, not result consistency), but it's worth knowing. No change needed.

Verdict

No issues found. The annotations are accurate and the PR description matches the diff exactly (10 read-only tools get idempotentHint, all 14 get openWorldHint: false). Ready to merge.