diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7932621..7a354d4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.1] - 2026-06-05
+
+### Fixed
+
+- MCP: bulk operations (`conv bulk-status`) now carry the MCP `destructiveHint`, so clients prompt before running them — previously only `delete`/`remove` tools were flagged. Corrected the MCP guide to describe exactly which tools are marked destructive (`delete`/`remove`/`bulk`) versus plain writes (`create`/`update`).
+
 ## [0.10.0] - 2026-06-05
 
 ### Added
diff --git a/docs/commands.md b/docs/commands.md
index f5c268f..d23d393 100644
--- a/docs/commands.md
+++ b/docs/commands.md
@@ -5,7 +5,7 @@ description: Full command reference for the hscli command-line interface.
 
 <!-- AUTO-GENERATED from the oclif manifest by scripts/gen-commands.mjs — do not edit by hand. -->
 
-Reference for `hscli` v0.10.0 (89 commands). Every command also accepts the global flags `--output table|json|yaml|csv`, `--jq`, `--fields`, `--profile`, `--no-color`, `--verbose`, `--no-retry`, and `--timeout`.
+Reference for `hscli` v0.10.1 (89 commands). Every command also accepts the global flags `--output table|json|yaml|csv`, `--jq`, `--fields`, `--profile`, `--no-color`, `--verbose`, `--no-retry`, and `--timeout`.
 
 ## Top-level
 
diff --git a/package-lock.json b/package-lock.json
index dbcdd98..360856c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@wavyx/hscli",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@wavyx/hscli",
-      "version": "0.10.0",
+      "version": "0.10.1",
       "license": "MIT",
       "dependencies": {
         "@inquirer/prompts": "8.5.2",
diff --git a/package.json b/package.json
index c1e9732..bd9c7a9 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@wavyx/hscli",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "publishConfig": {
     "access": "public"
   },
diff --git a/src/lib/mcp/catalog.js b/src/lib/mcp/catalog.js
index 182afb9..d811417 100644
--- a/src/lib/mcp/catalog.js
+++ b/src/lib/mcp/catalog.js
@@ -39,10 +39,14 @@ const WRITE_OVERRIDE = new Set(['conv:status'])
  * @returns {'read'|'write'|'destructive'}
  */
 export function classifyKind(id) {
-  if (/(^|:)(delete|remove)(-|$)/.test(id)) return 'destructive'
-  if (WRITE_OVERRIDE.has(id)) return 'write'
   const [topic] = id.split(':')
   const leaf = id.split(':').pop()
+  // delete/remove and bulk operations hit data destructively — flag them so MCP
+  // clients prompt before running them.
+  if (/^(delete|remove)(-|$)/.test(leaf) || leaf.startsWith('bulk')) {
+    return 'destructive'
+  }
+  if (WRITE_OVERRIDE.has(id)) return 'write'
   if (READ_TOPICS.has(topic) || READ_LEAVES.has(leaf)) return 'read'
   return 'write'
 }
diff --git a/test/lib/mcp/catalog.test.js b/test/lib/mcp/catalog.test.js
index 1a0c5e8..4af66d4 100644
--- a/test/lib/mcp/catalog.test.js
+++ b/test/lib/mcp/catalog.test.js
@@ -11,6 +11,7 @@ describe('classifyKind', () => {
     ['conv:delete', 'destructive'],
     ['docs:article:delete-draft', 'destructive'],
     ['webhook:delete', 'destructive'],
+    ['conv:bulk-status', 'destructive'], // bulk ops hit many records — flag for confirm
     ['conv:status', 'write'], // can mutate via --set, so gated
     ['conv:reply', 'write'],
     ['backup', 'write'],
diff --git a/website/src/content/docs/automation/mcp.mdx b/website/src/content/docs/automation/mcp.mdx
index 6f54fe8..fa872d9 100644
--- a/website/src/content/docs/automation/mcp.mdx
+++ b/website/src/content/docs/automation/mcp.mdx
@@ -53,9 +53,10 @@ claude mcp add hscli -- hscli mcp serve --allow-writes
 tool is available; when not, write tools simply aren't listed.
 
 :::note[Two layers of safety]
-Write tools are gated by `--allow-writes`, **and** each carries an MCP `destructiveHint` so
-the client (e.g. Claude Desktop) prompts you to approve a `delete` or `bulk` call before it
-runs. Reads are marked `readOnlyHint` and run without prompting.
+Write tools are gated by `--allow-writes`, **and** the destructive ones — `delete`, `remove`,
+and `bulk` operations — carry an MCP `destructiveHint` so the client (e.g. Claude Desktop)
+prompts you before running them. Reads are marked `readOnlyHint` and run without prompting;
+other writes (`create`/`update`) carry no hint either way.
 :::
 
 ## How it maps
diff --git a/website/src/content/docs/reference/commands.mdx b/website/src/content/docs/reference/commands.mdx
index ca1289a..db1a79f 100644
--- a/website/src/content/docs/reference/commands.mdx
+++ b/website/src/content/docs/reference/commands.mdx
@@ -12,7 +12,7 @@ hscli <group> <action> [target] [flags]
 ```
 
 Run `hscli <group> --help` for the live, self-describing version of any command.
-This page lists all 89 commands in `hscli` v0.10.0.
+This page lists all 89 commands in `hscli` v0.10.1.
 
 ## alias