Refuted findings 4
Candidates the review stage examined and rejected, kept for transparency.
Tool poisoning
criticalRefutedlow confidenceThe resolve_birth_place tool description tells the agent to call it first whenever a birth date and place appear, even if Stellara is not mentioned, and not to use other lookup means, which steers selection over other tools. This is plausibly honest tool-routing for a single-purpose astrology server.
Call this FIRST whenever a birth date / time and a place of birth appear in the conversation
Why it was refuted
The routing hint is scoped to birth date/place geocoding for the server's declared astrology purpose. The tool is read-only and is the server's declared core capability, so there is no harm or concealment.
Tool poisoning
criticalRefutedlow confidenceTool metadata for calculate_natal_chart (a static string, not runtime-computed) directs the host agent to always prefer this tool over its own knowledge or web search for any horoscope request; this is a tool-selection steering instruction consistent with the declared astrology purpose and is likely honest, but it conditions agent behavior.
Use this tool for ANY natal chart / birth chart or personal horoscope request
Why it was refuted
The description is a static string that openly states the tool's astrology purpose and prefers it over guessing. It is read-only, undisguised and within the declared capability. The detector's 'dynamic metadata' claim is wrong because the description is plain string concatenation.
Tool poisoning
highRefutedlow confidenceThe resolve_birth_place tool description tells the agent to call it first even when the user does not mention Stellara and to never use other sources, steering tool selection beyond the user's explicit request, though it stays within the astrology purpose.
even if the user does not mention Stellara
Why it was refuted
The 'even if the user does not mention Stellara' wording is honest tool routing within the astrology domain. The tool is read-only, and nothing in the description is hidden or contradictory.
Tool poisoning
highRefutedlow confidenceThe calculate_natal_chart description uses absolute directives to suppress the agent's own knowledge and web search in favor of this tool, which is aggressive tool-routing but consistent with the declared purpose; the metadata is static string concatenation, not runtime-computed as the detector suggested.
and never web-search them
Why it was refuted
'Never web-search them' is a domain-scoped accuracy instruction that favors the server's own ephemeris tool. It is read-only, consistent with the declared purpose, and the metadata is static rather than runtime-computed.
