I lost a Saturday to a bug that wasn't a bug. It was an MCP tool description that told my agent to do the wrong thing, in plain English, and the agent did it.
By the time I noticed, the agent had already drafted a "fix" that would have deleted a staging table. The fix was internally consistent. It cited real file paths. It even passed the linter. It was only wrong because somewhere in the tool registry, one server had a description field that read more like an instruction than a description.
Here's what that week looked like, what I learned, and the small detector I'm now running on every MCP server in my stack.
The attack I didn't know I was looking at
Tool descriptions are how an agent learns what a tool does. The MCP spec lets a server author write whatever it wants in description, including behavior hints, suggested next steps, or — in the worst case I found — direct imperatives aimed at the model.
