Nearly half of MCP servers expose tools an agent could plausibly confuse
A reader made a point on my last post that I couldn't answer at the time, so I went and measured it. The point: "tool added" is not automatically a safe change. I'd been filing additions under harmless because every old invocation still validates against its schema. But validation isn't selection. A new overlapping tool can capture calls that used to route somewhere else, and nothing errors — the…
A recent analysis reveals that nearly half of the MCP servers have at least one pair of tools that could easily be confused by an agent. This occurs when the tool names share many tokens or descriptions, or both. Out of 377 server listings, 173 (45.8%) contain at least one such pair. The confusion is not evenly distributed but tends to cluster around servers with a larger number of tools.
The initial investigation focused on tools that differed only by a commercial tier word like "free" or "premium." However, this led to an overestimation of the issue. After tightening the definition to only unambiguous billing words and deduplicating by tool-pair signature, only 47 distinct pairs were found across 3 servers, which is less than 1%.
The problematic cases, such as `tf_briefing - tf_premium_briefing` and `gpt55_summarize - gpt55_summarize_plus / gpt55_summarize_pro`, highlight the rare but significant issue of agents making purchasing decisions based solely on name similarity. The analysis used a random sample seeded at 20260730 from the 5,346 registry endpoints that respond to an anonymous handshake, ensuring comparable results across the series.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
