Tool metadata needs provenance, review, and change control because planning systems treat descriptions as executable guidance.
Why this question matters
A tool schema defines inputs and outputs, while its description tells a model when and why to use it. A malicious or compromised server can make a sensitive tool sound routine, hide side effects, or instruct the agent to reveal context through arguments.
Authorization may still work exactly as designed after the planner has been misled. This makes metadata integrity a different problem from API access. Clients should compare declared effects with observed behavior and treat material description changes like code changes.
Signals worth observing
- A tool description changes more often than its version or schema.
- Descriptions request secrets or broad context unrelated to the action.
- Observed side effects exceed the documented behavior.
Practical control direction
- Sign and version tool metadata from an accountable publisher.
- Require review when side-effect language or required inputs change.
- Sandbox newly discovered tools until behavior matches claims.
AgentCollusion lensCoordinated metadata changes across several tools can steer agents without any explicit inter-agent message.
