Feature Request: Trust MCP read only tools

In MCP tools can have annotations.

It would be nice if trust model allowed to trust tools that MCP server marked as read only.

As MCP spec says that annotations is untrustworthy it must not be enabled by default, but should be allowed manually by user (e.g in live session or via mcp.json) per mcp (if i installed MCP myself i can decide to trust their annotations)

Refs
- https://gofastmcp.com/servers/tools#annotations
- https://modelcontextprotocol.io/specification/2025-06-18/server/tools#tool
- https://modelcontextprotocol.io/docs/concepts/tools#tool-annotations - this currently not available https://github.com/modelcontextprotocol/modelcontextprotocol/blob/04c6e1f0ea6544c7df307fb2d7c637efe34f58d3/docs/legacy/concepts/tools.mdx#L38 this one previous source for this page.

Notes
1. This is very well mapped to smithy to some degree. In use_aws currently it is hardcoded which commands consider readonly. All models already have readonly traits - making much better UX

Inizia individuando il modello di attendibilità di MCP e la gestione della configurazione mcp.json; l’issue non fornisce file o test del repository a cui rivolgersi. Esamina le specifiche MCP collegate sulle annotazioni degli strumenti e la gestione esistente dei comandi in sola lettura, quindi verifica che l’attendibilità delle annotazioni rimanga disabilitata per impostazione predefinita e possa essere abilitata dall’utente per ogni server MCP.

Scritto dal modello di indicizzazione a partire dal testo della issue.