Your AI agent trusts its tools. Do the tools tell it the truth?
For CTOs, engineering leads and heads of QA who are connecting AI assistants to their own tools.
When an AI agent uses a tool, the tool's answer becomes the agent's truth. We build and run more than a dozen MCP servers of our own, and every surprise goes into a feedback journal. We found ten ways our own tools told an agent something false.
- AI agents and MCP servers
- Our own MCP servers
- Actions
- Data
- Security
- Records
What was at risk
A tool that says done when it did nothing
An agent cannot tell a tool that is right from a tool that sounds right. If a tool says "updated", the agent moves on.
A tool acting on the wrong project
With several per-project keys, a tool acted on the wrong project without a word. A suite landed in the default project.
Credentials in the agent's context
One scan mode echoed credentials from captured request bodies straight into the agent's context.
AI text stored as fact
Email summaries that inverted the meaning of the email were saved to the CRM. Enrichment attached contacts from a different company with the same name.
Five questions we ask of every MCP server, ours or a client's
- Nothing doneWhat does the tool return when it did nothing? Is that different from success?
- ListsIs every list either complete or labelled as cut?
- ScopeWhich project, tenant or account did the call act on, and does the answer say so?
- SecretsDoes any secret or personal data ever appear in the output?
- VersionDoes the reported version match the code that is actually running?
How we found it
- Where
- Our own MCP servers, driven from coding agents by our engineers every day: BugBoard, Flows, JRNY, Hireo, BetterFlow, the AI Security Toolkit, our mobile testing engine and others.
- How
- Each time a tool surprised an engineer or an agent, it went into a journal, and from there into an issue in the tool's own repository.
- What counted
- The defects that hurt are rarely crashes. They are answers that look fine.
- How we workedWe looked for prompt injectionWhere it showed upWe looked for prompt injection arriving through tool output, the attack most articles about agents lead with. Across our journals we found none. That does not mean it cannot happen.
What we found, and what it costs
- Finding1 of 10Wrong project: a tool acted on the wrong project without a wordWhat it costs youA suite landed in the default project; reads crossed project boundaries while writes did not.
- Finding2 of 10Silent success: a tool answered "Updated" and dropped the fieldsWhat it costs youSecurity scanners reported success while scanning nothing, because one interpreter was dead.
- Finding3 of 10Caps read as totals: a list capped at 100 was read as the full countWhat it costs youA health check reported 0 dead links when it had simply stopped at its limit. One result read "18/14 passed".
- Finding5 of 10Version drift: a server reported its current version while running month-old codeWhat it costs youA fix landed and a restart did not pick it up.
- Finding8 of 10Sensitive data in tool output: credentials from captured request bodiesWhat it costs youThey went straight into the agent's context.
The other five of the ten: schema says one thing and behaviour another, errors nobody can act on, AI text stored as fact, output too large, and false liveness.
What changed
A write is now checked by reading it back, and "Updated" with nothing changed is an error. Every count says whether it is complete. Project scope is explicit. Unsafe settings are refused at creation, and values are redacted by default: tools return the shape of sensitive data, never the data.
The longer write-up, with all ten: what we learned building and running our own MCP servers.
Building agents or MCP servers of your own?
We test them the way we test ours: by finding where the answer looks right and is not. The first month is a trial.
