Agents and Tool Calling: What Could Go Wrong?

Questions

1. 1
   Not answered. An agent keeps calling the wrong tool. What should you fix first?
2. 2
   Not answered. Which content belongs in a tool's description rather than in the system prompt?
3. 3
   Not answered. What is the documented risk when a request does not supply a required tool parameter?
4. 4
   Not answered. What does strict schema enforcement on tool inputs actually guarantee?
5. 5
   Not answered. Which change most reliably stops a model from emitting an invalid status value?
6. 6
   Not answered. Two connected MCP servers each expose a tool named search. What does the specification say about the collision?
7. 7
   Not answered. Why does the MCP specification say servers should return tools in a deterministic order?
8. 8
   Not answered. Which stop_reason value does the Claude Messages API return when the model wants you to run a client-side tool and send the result back?
9. 9
   Not answered. How should an agent loop respond to stop_reason: "pause_turn"?
10. 10
    Not answered. The response ends with an incomplete tool_use block and stop_reason: "max_tokens". What is the correct recovery?
11. 11
    Not answered. What is the correct termination condition for a tool-calling agent loop?
12. 12
    Not answered. A search tool returns an empty string when nothing matches. Why does the agent then call it six times?
13. 13
    Not answered. Which are sound reasons to cap the number of iterations in a client-side agent loop?
14. 14
    Not answered. Why did parallel tool calling gradually stop happening in this conversation history?
15. 15
    Not answered. Where is disable_parallel_tool_use specified in an Anthropic Messages API request?
16. 16
    Not answered. Which tool-call batches must not be run concurrently just because the model emitted them in one turn?
17. 17
    Not answered. You ran a batch sequentially, an early call failed, and you never executed the last one. What do you send back for it?
18. 18
    Not answered. Why can a harness parallelize a grep tool but must serialize the same search issued through a general bash tool?
19. 19
    Not answered. Results come back from a worker pool out of order. How do you associate each one with the call that produced it?
20. 20
    Not answered. By RFC 9110's definition, what makes a request method idempotent?
21. 21
    Not answered. In MCP tool annotations, what is the default value of idempotentHint when a server does not set it?
22. 22
    Not answered. A remote MCP server advertises delete_everything with readOnlyHint: true. What does the specification require of the client?
23. 23
    Not answered. A payment tool timed out, the model retried, and the customer was charged twice. What is the actual defect?
24. 24
    Not answered. Who must generate an idempotency key, and when, for retry safety to hold?
25. 25
    Not answered. The same Idempotency-Key arrives with a different request payload. What should the server do?
26. 26
    Not answered. An MCP tool's upstream API rejects a badly formatted date. Which error channel should the server use?
27. 27
    Not answered. Which error string gives a model the best chance of fixing its own call on the next turn?
28. 28
    Not answered. Is an error string that embeds a remote response body safe to hand back to the model?
29. 29
    Not answered. An MCP server accepts whatever bearer token the client sends and forwards it to a third-party API. What does the specification say?
30. 30
    Not answered. An MCP server returns basket_id: "bsk_a1b2c3" and accepts it back on later calls. What must it not assume?
31. 31
    Not answered. What does the MCP specification say about human oversight of tool invocation?
32. 32
    Not answered. What is the primary risk in one-click installation of a local MCP server?
33. 33
    Not answered. Which capabilities make up the "lethal trifecta" for AI agents?
34. 34
    Not answered. An agent has all three trifecta capabilities. Which mitigation actually changes its security properties?
35. 35
    Not answered. Besides tool results, where else can injected instructions reach a model in an MCP setup?
36. 36
    Not answered. A user approved a server's tools on day one. Why is that approval not durable?
37. 37
    Not answered. What is the core principle behind design patterns that give agents provable resistance to prompt injection?
38. 38
    Not answered. Which root causes does OWASP name for Excessive Agency in LLM applications?
39. 39
    Not answered. Which control would have prevented the mail-forwarding outcome, rather than only limiting the damage?
40. 40
    Not answered. The agent runs as a service account that can read every user's records and is told to filter by the current user. What is wrong?
41. 41
    Not answered. Which scope model do MCP's security best practices recommend for authorizing an agent?
42. 42
    Not answered. Why is injecting a credential at the network boundary safer than putting it in the agent's system prompt or memory file?