Agent Wranglers

AID-75Recommended

Read every tool description and allow only the tools the task needs

Before a server's tools reach an agent, a person reads each tool's description and input schema. The agent's permissions allow by name only the tools the work needs.

By Agent Wranglers. Updated .

Spec version

MCP 2026-07-28

Review by

2027-06-30

How to do it

The model reads every tool description as part of its prompt, so a description can carry hidden orders. The MCP specification tells clients to treat tool annotations as untrusted unless the server is trusted. List the tools with the server's tools/list call and read them in full. Scan them for invisible characters as Review agent settings like code does for instruction files. Store a hash of the list and fail when it changes, so a new version is read again. Then allow single tools by name in the agent's permission rules, such as mcp__db__query, and deny tools that write, delete or send. Fewer tools also leave more room in context.

Examples

JSON example

{
  "permissions": {
    "allow": ["mcp__db__query", "mcp__db__describe_table"],
    "deny": ["mcp__db__execute", "mcp__db__drop_table"]
  }
}

Shell example

# tools.sha256 is committed after a person reads the tool list
npx -y @modelcontextprotocol/inspector@2.12.0 --cli node ./mcp-db/server.js --method tools/list \
  | sha256sum | diff - tools.sha256 || { echo "Tool descriptions changed. Read them, then update tools.sha256."; exit 1; }

How to check

A CI job fetches each listed server's tool list and compares its hash with the committed one. A changed description fails the job until a person commits the new hash. In a test session, ask the agent to call a denied tool. It is refused.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/mcp-tool-review">Agent Wranglers AI-assisted development playbook</a>. In code you write, add a comment next to it with the same link.