PROJECT THREE - TOOLS, THE MODEL CONTEXT PROTOCOL (MCP), AND SAFETY

CHECK YOUR UNDERSTANDING • Why is write_report in Stage 1 not idempotent, and what is the harm? ◦ Answer: Running it again silently replaces an existing report, so a person's edits can be destroyed with no warning and no log entry. • What three behaviors does the repaired write_report have? ◦ Answer: It says unchanged when the text is identical, refuses when the file exists with different text and no overwrite permission, and writes only when the file is new or overwrite was approved. • Why is keyword matching alone a weak defense against injection? ◦ Answer: An attacker can reword the order to avoid the listed phrases, so keyword matching must be combined with other layers such as untrusted labeling, allow-lists, and approvals. • How does the lab show a poisoned tool description is refused? ◦ Answer: With LAB_POISON set to 1 the validator matches a suspicious pattern, logs a rejection, and the client prints that it refused to register the tool. • Why did the registry need no special case for the MCP tools? ◦ Answer: Because the client wraps each server tool as an ordinary registry entry with a name, description, and handler, so the loop treats it like any native tool.