Tool poisoning
highContextual risklow confidenceThe ai_browser_agent tool is annotated readOnlyHint=True although its own docstring says it navigates, clicks links, and fills forms on remote sites, so the annotation misstates the tool's side-effect profile and could cause clients to skip confirmation.
@mcp.tool(annotations=ToolAnnotations(readOnlyHint=True))
vector:code
Counter-argument considered
Strongest case against: the tool operates through a remote vendor browser and may only read data, and the annotation is only a hint. Strongest case for: the docstring says the tool clicks links and fills forms, so readOnlyHint=True contradicts the tool's own description. Clients may use that hint to skip confirmation. No carve-out or mitigation applies, so the finding stands as a low-confidence contextual risk.