The available tool set is session-specific. Inspect the capability list, read the proposed arguments, approve only the intended operation, and verify the result. Tool names and schemas are versioned implementation contracts.
Tools can read or change local state and can invoke external services. Do not infer a tool’s safety from its name; review scope, inputs, outputs, and approval state.
