Secure tooling

A tool is where tool call abuseProbabilistic risksThe model is probabilistic, so its failures are too: three threats, four things at stake.Opens in a new tab becomes real, so a tool is treated like a dependency: described in a manifest file, pinned to a version, deployed and monitored. How the model picks one is in tool useTool useFunction calling gives the model hands: it asks, and code does the work.Opens in a new tab.

The manifest

A JSON file that says what the tool is, what it takes, and what it may do. The MCP specification’s tool definition has a name, a description and an input schema (plus optional title, output schema and annotations). The version, scopes and requiresApproval fields below are ours, not the spec’s.

{  "name": "issue_refund",  "version": "2.1.0",  "description": "Refund a paid order.",  "inputSchema": {    "type": "object",    "properties": {      "order_id": { "type": "string" },      "amount": { "type": "number", "minimum": 0 }    },    "required": ["order_id", "amount"]  },  "scopes": ["payments:refund"],  "requiresApproval": true}

Habits

• Strict versioning. The description and schema are what the model reads, so changing them changes behavior. MCP servers can announce a changed tool list at runtime, and a pinned manifest is how you notice.
• Least privilege. OWASP’s advice: only the tools the task needs, with only the permissions they need, and no open-ended ones like a raw shell. Check authorization in the downstream system too, not only in the agent.
• Make mistakes hard. Anthropic’s poka-yoke rule: change the arguments so errors are harder. Its example is requiring absolute file paths.
• Secure deployment. The spec says servers must validate inputs, control access, rate limit and sanitize outputs.
• Monitoring. Log every tool call for audit, and treat annotations from an untrusted server as untrusted (see traceabilityTraceabilityLog the whole reasoning trace, so any answer can be explained afterwards.Opens in a new tab).

The tools that need a person in front of them are the ones marked requiresApproval, which feeds the approval pauseHuman in the loopA pause in the agent's decision, where a person approves before a high-risk action runs.Opens in a new tab. The standard way to expose tools is MCPMCPModel Context Protocol: one standard way for an agent to reach tools and data.Opens in a new tab.