[vinmay]

Fixes: N/A

Summary

Changes

suggest_aws_commands declares openWorldHint=False, while call_aws in the same file, which also talks to AWS services, declares openWorldHint=True. Every suggest_aws_commands call sends the user's query to a remote endpoint:

• suggest_aws_commands → get_requests_session() → session.post(ENDPOINT_SUGGEST_AWS_COMMANDS, json={'query': query}, timeout=30) (server.py)
• ENDPOINT_SUGGEST_AWS_COMMANDS = os.getenv('ENDPOINT_SUGGEST_AWS_COMMANDS', 'https://api-mcp.global.api.aws/suggest-aws-commands') (core/common/config.py)

Per the MCP spec, openWorldHint says whether a tool may interact with an "open world" of external entities (the spec's example of open is web search; of closed, a memory tool). Sending user-provided text to a remote service makes this tool open-world, even though the endpoint is fixed: a fixed endpoint narrows where the query goes, not whether it leaves the machine.

This PR changes only that hint (plus a CHANGELOG entry). readOnlyHint=True stays: the tool doesn't modify the environment.

Tested: uv run --frozen pyright (0 errors), the aws-api-mcp-server unit tests (uv run --frozen pytest tests: 739 passed), and pre-commit run on the changed files (all hooks pass).

Why this matters

A user who asks for command suggestions has their query sent to a remote service. Queries can include account details, resource names, or what the user is trying to do (the tool's own examples include "List all IAM users who have AdministratorAccess policy"). The user had no reason to expect that from a closed-world tool. The endpoint being AWS's own service doesn't change this: the hint describes whether the tool reaches outside the user's environment, not whether the destination is trustworthy.

User experience

Before: clients that use openWorldHint to decide what to auto-approve, and policies that restrict tools sending data off-machine, may treat suggest_aws_commands as closed-world and let it send the user's query to a remote service without asking.

After: the tool is declared open-world, so those clients and policies apply their open-world handling (e.g. prompting before the first call).

How this was found

Spotted while testing ReachScan's annotation checks, then traced by hand.

Checklist

If your change doesn't seem to apply, please leave them unchecked.

• I have reviewed the contributing guidelines
• I have performed a self-review of this change
• Changes have been tested
• Changes are documented

Is this a breaking change? (Y/N) N

RFC issue number:

Checklist:

• Migration process documented
• Implement warnings (if it can live side by side)

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.