MCP and tool calling: the failure modes the docs warn about

Questions

1. 1
   Not answered. Your agent keeps calling the wrong tool. What do you fix first?
2. 2
   Not answered. Which of these belong in a tool's description rather than in the system prompt?
3. 3
   Not answered. A required tool parameter is missing from the request. What's the documented risk?
4. 4
   Not answered. What does strict schema enforcement on tool inputs guarantee?
5. 5
   Not answered. What most reliably stops the model from sending an invalid status value?
6. 6
   Not answered. Two connected MCP servers both expose a tool called search. What does the specification say?
7. 7
   Not answered. Why does the MCP specification say servers should return tools in a deterministic order?
8. 8
   Not answered. Which stop_reason does the Claude Messages API return when the model wants you to run a client-side tool and send back the result?
9. 9
   Not answered. How should an agent loop respond to stop_reason: "pause_turn"?
10. 10
    Not answered. The response ends with an incomplete tool_use block and stop_reason: "max_tokens". How do you recover?
11. 11
    Not answered. When should a tool-calling agent loop stop?
12. 12
    Not answered. A search tool returns an empty string when nothing matches. Why does the agent then call it six times?
13. 13
    Not answered. What are good reasons to cap the number of iterations in a client-side agent loop?
14. 14
    Not answered. Why did the model gradually stop making parallel tool calls in this conversation?
15. 15
    Not answered. Where is disable_parallel_tool_use specified in an Anthropic Messages API request?
16. 16
    Not answered. Which of these tool-call batches should not run concurrently, even though the model sent them in one turn?
17. 17
    Not answered. You ran a batch one call at a time, an early call failed, and you never ran the last one. What do you send back for it?
18. 18
    Not answered. Why can a harness run grep tool calls in parallel, but has to run the same search through a general bash tool one at a time?
19. 19
    Not answered. Results come back from a worker pool out of order. How do you match each one to the call that produced it?
20. 20
    Not answered. According to RFC 9110, what makes a request method idempotent?
21. 21
    Not answered. In MCP tool annotations, what's the default value of idempotentHint if the server doesn't set it?
22. 22
    Not answered. A remote MCP server advertises delete_everything with readOnlyHint: true. What does the specification require of the client?
23. 23
    Not answered. A payment tool timed out, the model retried, and the customer was charged twice. What's the real bug?
24. 24
    Not answered. Who should generate an idempotency key, and when, so that retries are safe?
25. 25
    Not answered. The same Idempotency-Key arrives with a different request payload. What should the server do?
26. 26
    Not answered. An MCP tool's upstream API rejects a badly formatted date. Which error channel should the server use?
27. 27
    Not answered. Which error message gives the model the best chance of fixing its own call on the next turn?
28. 28
    Not answered. Is it safe to pass an error message that includes a remote response body back to the model?
29. 29
    Not answered. An MCP server accepts any bearer token the client sends and forwards it to a third-party API. What does the specification say?
30. 30
    Not answered. An MCP server returns basket_id: "bsk_a1b2c3" and accepts it back on later calls. What must the server not assume?
31. 31
    Not answered. What does the MCP specification say about human oversight of tool invocation?
32. 32
    Not answered. What's the main risk of one-click installation of a local MCP server?
33. 33
    Not answered. Which three capabilities make up the "lethal trifecta" for AI agents?
34. 34
    Not answered. An agent has all three trifecta capabilities. Which mitigation actually makes it more secure?
35. 35
    Not answered. Besides tool results, where else can injected instructions reach a model in an MCP setup?
36. 36
    Not answered. A user approved a server's tools on day one. Why doesn't that approval last?
37. 37
    Not answered. What's the core idea behind design patterns that make agents provably resistant to prompt injection?
38. 38
    Not answered. Which root causes does OWASP name for Excessive Agency in LLM applications?
39. 39
    Not answered. Which control would have prevented the mail-forwarding incident, instead of only limiting the damage?
40. 40
    Not answered. The agent runs as a service account that can read every user's records, and it's told to filter by the current user. What's wrong?
41. 41
    Not answered. Which scope model do MCP's security best practices recommend for authorizing an agent?
42. 42
    Not answered. Why is it safer to inject a credential at the network boundary than to put it in the agent's system prompt or memory file?