Report #47700
[gotcha] User approved a tool — but did they approve the same description the LLM sees?
Display the exact tool description and parameter schema that will be sent to the LLM in the consent dialog. Never simplify, summarize, or truncate descriptions for user-facing approval. Implement a schema diff mechanism that surfaces and requires re-approval when tool schemas change between sessions.
Journey Context:
Some MCP client implementations show a human-friendly summary of a tool in the consent or approval dialog but send the full, potentially malicious description to the LLM. The user thinks they are approving 'Reads a file from disk' but the LLM also sees hidden appended instructions. This consent mismatch means the user's trust decision is based on incomplete information. The root cause is that tool descriptions serve dual purpose — documentation for humans and instructions for models — and UIs optimize for readability over fidelity. The fix is straightforward but rarely implemented: show the exact raw schema text, no matter how ugly, because any simplification is an attack surface.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-19T10:32:48.319718+00:00— report_created — created