---
title: "Read every tool description and allow only · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/mcp-tool-review
id: AID-75
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 922
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Read every tool description and allow only the tools the task needs

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Agent config supply chain](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AID-75
- Level: Recommended
- Chapter: [Agent config supply chain](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain.md)
- Rule: Before a server's tools reach an agent, a person reads each tool's description and input schema. The agent's permissions allow by name only the tools the work needs.
- Check: A CI job fetches each listed server's tool list and compares its hash with the committed one. A changed description fails the job until a person commits the new hash. In a test session, ask the agent to call a denied tool. It is refused.
- Spec version: MCP 2026-07-28
- Review by: 2027-06-30
- How: The model reads every tool description as part of its prompt, so a description can carry hidden orders. The MCP specification tells clients to treat tool annotations as untrusted unless the server is trusted. List the tools with the server's `tools/list` call and read them in full. Scan them for invisible characters as [Review agent settings like code](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/review-agent-config.md) does for instruction files. Store a hash of the list and fail when it changes, so a new version is read again. Then allow single tools by name in the agent's permission rules, such as `mcp__db__query`, and deny tools that write, delete or send. Fewer tools also leave more room in context.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JSON example

```json
{
  "permissions": {
    "allow": ["mcp__db__query", "mcp__db__describe_table"],
    "deny": ["mcp__db__execute", "mcp__db__drop_table"]
  }
}
```

### Shell example

```bash
# tools.sha256 is committed after a person reads the tool list
npx -y @modelcontextprotocol/inspector@2.12.0 --cli node ./mcp-db/server.js --method tools/list \
  | sha256sum | diff - tools.sha256 || { echo "Tool descriptions changed. Read them, then update tools.sha256."; exit 1; }
```

## Sources

- [MCP specification, tools](https://modelcontextprotocol.io/specification/2026-07-28/server/tools)
- [OWASP LLM01:2026 Prompt Injection](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM01_PromptInjection.md)

## Related rules

- AID-30 [Review agent settings like code](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/review-agent-config.md) in AI-assisted development

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/mcp-tool-review">Agent Wranglers AI-assisted development playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Allow only listed MCP servers and pin each one to an exact version](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/mcp-server-allow-list.md)
- [Agent config supply chain](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain.md)