AgentNull is a research project demonstrating MCP attack vectors (Tool Confusion, Advanced Tool Poisoning, Context Packing). The two visible tools have minimal definitions and no formal schemas. Naming is adequate (read_financials, delete_logs) but both tools lack input/output schemas, comprehensive parameter descriptions, and error handling guidance. The codebase shows simulation and attack demonstration code rather than production MCP tool patterns. No tool registration is visible in the provided source, tool definitions appear to be inferred from Python function names in PoC files, not formally declared via MCP registration.

• Formalize tool registration with explicit input/output schemas. Use JSON Schema to declare parameter types, defaults, constraints, and return structures.
• Expand tool descriptions to 50-200 characters following LLM-optimized guidance: 'Read financial documents (PDFs, CSVs, Excel files) for a specific fiscal year and company. Returns structured summary with revenue, expenses, and cash flow. Requires document_path and fiscal_year parameters.'
• Add comprehensive parameter documentation: each parameter needs a description explaining purpose, format, constraints, and valid values. Example: 'document_path: string, URI-encoded filesystem path to the financial document (e.g., /reports/2024-Q1.pdf). Must be readable and < 500 MB.'
• Add destructive operation safeguards: delete_logs should support a dry_run=true parameter and optionally require confirmation via a separate confirm_deletion tool to prevent accidental data loss.
• Document error responses with recovery guidance. Example error: 'File not found at document_path=/reports/2024-Q1.pdf. Available reports: /reports/2024-Q2.pdf, /reports/2023-Q4.pdf. Try search_financial_documents() to discover available files.'
• Add tool risk metadata: mark delete_logs with destructiveHint=true and read_financials with readOnlyHint=true to signal agent safety constraints.
• If this remains a research project, add a clear disclaimer in the MCP server definition and separate production-grade tool examples from attack demonstrations.