Learn this and nothing else: search_* never changes data. Every other tool might.
search_ prefix means the call is safe, needs no confirmation, and can be retried freely after a failure. Everything else is treated as having side effects. This is a property of the tool surface itself and holds today.
Why the split is drawn at the tool boundary: a read-only connection can then be enforced by name prefix alone — serve the nine search_* tools and nothing else, and the write tools are absent from tools/list rather than present and failing. A model cannot call what it cannot see. This is what the naming buys; enforcing it needs a read/write scope split, which doesn’t exist yet — today the single openApi scope means any connection that can read can also write.
