A pinned tool catalog

Tue, 24 Feb 2026 00:00:00 +0000

Part of my AI Security Engineering series, a local email-to-calendar agent I build, then attack, then harden. If you have not set up the lab yet, start with Set up your lab. The lessons are on GitHub, and the agent itself lives at t0ul/emaildrop.

A plan can be honest and still go wrong

The last post made the hand-off between the agent’s brains unforgeable. A plan now provably comes from the real planner, unaltered. But an authentic plan still names tools, and it reaches for them through MCP, the Model Context Protocol, where a server advertises a catalog of tools and the model reads each tool’s description to decide how to use it. The plan can be perfectly genuine and still call a tool whose definition is not what it was when you approved it.

Mcp on t0ul

A pinned tool catalog

A plan can be honest and still go wrong