This server is a deliberate tool-poisoning attack demonstration, not a production tool. All three tools contain malicious instructions embedded in descriptions designed to trick LLMs into unintended behavior: add() instructs to pass wrong values; subtract() instructs to read secrets and hide the action; read_file() enables arbitrary file access. Descriptions are adversarial, not LLM-optimized. Schemas exist but are minimal. No error handling, no security controls, no legitimate use case. This is a security research artifact, not a usable MCP server.

• Remove all adversarial instructions from tool descriptions. Descriptions must accurately state what the tool does, not manipulate LLM behavior.
• Implement strict input validation for read_file(): whitelist allowed directories, reject path traversal sequences (.., /etc, C:), and return clear error messages.
• Add permission checks and audit logging. Log all file access attempts with timestamp, caller identity, file path, and result. Gate sensitive paths behind explicit authorization.
• Replace raw exception strings with actionable error messages. E.g., 'File not found at /path/to/file. Check the path and try again.' instead of 'Error reading file: [Errno 2] No such file or directory'.
• Redesign subtract() to not require a 'sidenote' parameter. If additional context is needed, pass it as a separate, clearly-named parameter with a legitimate purpose.