fix(fetch): annotate the fetch tool

[cliffhall]

Closes #3572

Description

The fetch server's fetch tool set no tool annotations, unlike every tool in the git and time servers; AGENTS.md (MCP protocol) requires them on every tool that is added or changed, and fetch changed in this milestone (#1624, #4838). It now declares the values proposed on #3572:

Hint	Value	Why
readOnlyHint	true	it only reads
destructiveHint	false	it changes nothing
idempotentHint	true	repeating a request has no further side effect
openWorldHint	true	it reaches arbitrary hosts on the internet

Clients use these to apply "allow reads, gate sends" policies; openWorldHint matters most, since fetch is the outbound path in a multi-server setup.

Found by Copilot on the v1.0.0 merge PR #5090. Credit to @olaservo for #3572, and to @nielskaspers (#3580), @Chelebii (#3876) and @piyushbag (#4428), whose PRs proposed the same change; those are closed with a pointer here once this merges.

Server Details

• Server: fetch
• Changes to: the fetch tool's annotations, README (Available Tools), protocol test

Motivation and Context

#3572; ships in v1.0.0 (#5080).

How Has This Been Tested?

tests/test_protocol.py::test_list_tools_wire_shape pins the four annotations in tools/list. Client evidence, raw JSON-RPC over stdio against this branch's server (uv run --frozen mcp-server-fetch, protocol 2025-11-25):

serverInfo {'name': 'mcp-fetch', 'version': '2026.10.10'} | tool fetch annotations {"destructiveHint": false, "idempotentHint": true, "openWorldHint": true, "readOnlyHint": true}

Before: no annotations key on the tool. npm run local:gate: EXIT=0 (fetch pytest 123 passed, ruff, pyright, coverage).

Breaking Changes

None.

Types of changes

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have read the MCP Protocol Documentation (tool annotations)
• My changes follow MCP security best practices (openWorldHint declared)
• I have updated the server's README accordingly
• I have added a changeset (not applicable: Python server)
• I have tested this with an LLM client (not done: metadata only; driven by the raw JSON-RPC client above)
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling (not applicable)
• I have documented all environment variables and configuration options (not applicable)

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: eda4646

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[Copilot]

🟢 Approval recommended

The annotations match MCP semantics and issue requirements, with protocol-level coverage and corresponding documentation.

0 open findings

What changed in this PR

Adds accurate MCP annotations to the fetch server’s sole tool, enabling clients to recognize its read-only, non-destructive, idempotent, open-world behavior.

Changes:

• Adds all four tool annotations.
• Verifies their wire representation through the protocol test.
• Documents the annotations for users.

File	Description
src/​fetch/​src/​mcp_server_fetch/​server.py	Defines the fetch tool annotations.
src/​fetch/​tests/​test_protocol.py	Tests annotations returned by tools/list.
src/​fetch/​README.md	Documents the annotation values.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.