A security architect worries that a prompt-injected model could slip sensitive data into tool arguments and send it to a third-party MCP server. Which client practice does the tools specification recommend specifically to avoid this kind of exfiltration?
Select an answer to reveal the explanation.
Short Explanation
Before a letter leaves your mailroom, someone glances at what's inside the envelope. That's showing tool inputs to the user before the call goes out. The trap is a schema tweak that still lets secrets ride inside allowed fields.
Full Explanation
The client-side security considerations in the tools specification recommend that clients show tool inputs to the user before calling the server, to avoid malicious or accidental data exfiltration. A model influenced by injected instructions can place sensitive text into perfectly valid argument fields, and only a review of the actual values before they leave the client gives the user the chance to stop it. Setting additionalProperties false is good schema hygiene, but it cannot prevent sensitive data from being placed in the fields the schema allows, and the schema is written by the server, not controlled by the client. Mirroring every argument into Mcp-Param headers would spread the data further, to every intermediary that sees headers; the specification warns servers not to mark sensitive parameters with x-mcp-header for exactly that reason, and the annotation is the server's choice per parameter. Output sanitization is a server obligation that applies to results, and it runs after the server has already received the data, which is too late. Exam caveat: input review complements, rather than replaces, user confirmation for sensitive operations and validation of tool results before they reach the model. Operational check: invoke a tool in the host and confirm the approval UI shows the full argument values that will be sent.