I gave an AI agent a production rollback button — then spent the hackathon trying to trick it into pressing it

A one-line omission in an MCP tool definition is enough to make an AI agent's approval gate silently disappear. Here's how I found it, closed it three ways, and then built a suite whose only job is to attack my own fix.

There is a function in TrueForge, the open-source agent harness, that decides whether an AI agent is allowed to touch your production systems without asking you first.

It is four lines long.

// trueforge-core/src/core/mcp/toolSelectors.ts

function isReadOnly(a?: ToolAnnotations) { return a?.readOnlyHint === true; }