How a tool behaves, which tells the MCP server how to expose it: readonly tools
only read data, mutating tools change it, and tools ask for
confirmation before running.
destructive
Signature
type McpToolBehavior = 'readonly' | 'mutating' | 'destructive'