wtf( )unctionsystem design, drawn
← all problemsMCPEasy

The agent emptied the folder it was asked to tidy

The server exposes a tool that deletes records, because tidying up was the point. The tool's description says to use it carefully, and your system prompt says to confirm with the user first.

Both of those sentences are in the same context window as the document the agent just read, which also contains instructions. The model followed the more recent ones.

Put the confirmation somewhere the model cannot talk its way past.
Components — tap one, then tap a slot on the diagram
?A tool that deletes is one sentence away from being called. The model is not the place to put the brake.

Boundaries, outermost first: One context window: A fetched document (with instructions), Your system prompt ('confirm first'), The model (one input channel) Outside every boundary: delete_records (flagged destructive; FAILED: called without asking), an empty slot for the decides before the call is sent Connections: Your system prompt controls The model (step 1) A fetched document controls The model — same window (step 2) The model calls decides before the call is sent (step 3) decides before the call is sent calls delete_records — only once approved (step 4) The model must NOT reach delete_records — not directly

delete_recordsflagged destructivecalled without asking
A fetched documentwith instructions
Your system prompt'confirm first'
The modelone input channel