Read vs write: how 4 task app MCP servers split 271 tools

Roughly half the tools a task app's MCP server hands an agent can change your data. We sorted the 271 documented tools of four servers, Done, Jira through Atlassian's Rovo server, Notion and ClickUp, into reads and writes: 129 only read (48%) and 142 write (52%). The share of read-only tools ranges from 54% for Jira and Notion down to 42% for Done. Every write is a call an agent can make with your authority, which is why the annotations that tell an AI app which tools are safe to run unattended matter more than the tool count.

How many MCP tools only read?

The four servers were built separately and still land within 12 points of an even split. That's not a coincidence: a task app is mostly things to look up and things to change, and an agent needs both to do anything useful. Done sits lowest because its tools are written for an agent that works the queue, so the loop's steps (claim, report progress, propose completion, ask a question, release) are writes on purpose.

Which writes can't be undone?

Far fewer, and each server draws the line in a different place. Atlassian puts Jira's three permanent deletes (a work item, a comment, an attachment) in their own permission group, off until an admin enables it, alongside six admin tools. Notion's deletes move up to 20 pages or databases to the trash, where a restore tool can bring them back. ClickUp lists two delete tools, for tasks and comments. Done's deletes are soft, sent to a trash that's purged after 30 days, but Done marks 13 tools destructiveHint anyway, including every update that overwrites a field, because what matters to the person watching is what they stop being able to see.

What do readOnlyHint and destructiveHint actually tell an AI app?

They're hints a server attaches to each tool so the app running the agent can decide what to confirm with you. The MCP specification's defaults are cautious: a tool with no annotations is assumed to write (readOnlyHint false), to be destructive (destructiveHint true), not idempotent, and to reach the open world (openWorldHint true). The spec also says annotations are hints, not guarantees, and that a client should never trust them from an untrusted server. So a server that annotates nothing gets treated as dangerous by careful apps, and one that annotates honestly lets them skip a confirmation for every read.

• readOnlyHint: true means the tool doesn't modify anything. Default false.
• destructiveHint: true means a write may destroy or overwrite rather than only add. Meaningful only for writes. Default true.
• idempotentHint: true means calling the write again with the same arguments changes nothing more. Default false.
• openWorldHint: true means the tool reaches outside the server's own data, such as the web or another product. Default true.

What this means if you connect an agent to your task app

Assume half of what you've granted can change things, and check which half. On Linear you can connect the read-only endpoint instead. On Jira an admin can leave the delete and admin groups off. On Done you can mint a read-only token, or one limited to a single project. And because an annotation only describes a single call, not whether the overall result was right, the stronger guard is on the task: in Done an agent proposes completion and the task waits for your approval, unless you marked it agent-ok.

How we counted

• Done: every tool's annotations as Done's server emits them on October 28, 2026; read-only means readOnlyHint true. Of its 50 writes, 21 are marked idempotent and 3 tools reach other apps (openWorldHint true).
• Jira: Atlassian's own groups. Read covers its 27 read tools and 1 search tool; write covers 15 write, 3 delete and 6 admin tools.
• Notion and ClickUp publish no read or write flag in their docs, so we sorted each documented tool by its name and description: get, list, fetch, search, query, find and download count as reads; create, update, move, merge, send, start, stop, delete and the like as writes.
• Percentages are rounded to the nearest whole number.