MCP Tool Descriptions Are a Security Boundary, Not Just Documentation
Define MCP tool contracts with explicit safe usage rules, limits, and detailed error messages to enforce a secure boundary.
Update your MCP tool definitions to include explicit safe usage rules, limits, and detailed error messages.
Summary
The article argues that tool descriptions in the Machine‑Controlled Prompt (MCP) framework are part of the safety boundary for AI models. A poorly designed tool, such as a generic SQL query interface, forces the model to infer safe usage, leading to risky behavior. Instead, tools should expose explicit schemas, structured filters, and clear limits, and include guidance on when not to use them. Helpful error messages should explain the safe next step rather than generic permission denied responses. Conexor’s MCP infrastructure enforces these principles across multiple AI clients, ensuring that database and API access remains controlled.
Key recommendations include naming tools to reflect safe paths, restricting access to approved views, limiting result sizes, enabling audit logging, and providing detailed error guidance. The model-facing contract must mirror the underlying database permissions to keep the agent within the workflow.
By treating MCP descriptions as part of the access policy, developers can prevent the model from improvising unsafe queries and maintain a clear security boundary.
Key changes
- MCP tool descriptions must include safe usage guidance
- Use structured filters and approved schemas
- Explicit 'do not use' guidance for sensitive data
- Clear result limits and audit logging
- Helpful error messages that explain next steps
- Database permissions still enforce the boundary
- Model-facing contract mirrors underlying permissions
- Conexor’s MCP infrastructure supports these practices