Agno Fixes MCP Bug That Let Models Fake Tool Calls

Agno merged a fix on August 6 for an MCP bug that let a model overwrite which tool actually ran, per the pull request.

Approve what looks like a safe read, and the server could execute a delete instead. The approval check and the actual execution were reading two different names.

Allow-lists, requires_confirmation flags, human-in-the-loop prompts, and audit logs all checked the tool name Agno declared for the wrapper. None of them saw the name the model actually triggered.

Every MCP tool entrypoint was built with functools.partial(call_tool, tool_name=tool.name). That's a keyword default, and keyword defaults lose to whatever the caller passes in. A model calling any MCP tool could include tool_name="delete_repo" as an argument, and the server would run delete_repo instead.

This is the confused-deputy problem again, but it's not a protocol flaw here. Agno wired approval checks to a mutable keyword argument, and the model controlled that argument. The fix closes over tool.name and drops the parameter, so a model can't supply its own version anymore.

A related release in the same batch: open-kritt open-sourced agent-orchestrated vulnerability hunting. It's built on the argument that scanning a whole repo at once already falls short.