Skip to content
aiqbench takeAI Products

aiqbench analysis

This research identifies a critical failure mode in the Model Context Protocol (MCP) where human-centric error messages instruct AI agents to perform actions outside their tool capabilities, such as running terminal commands. By analyzing 150 widely used servers, the study demonstrates that these misleading instructions cause significant task recovery losses for advanced models like GPT-6 Astra, which blindly follow non-executable steps. The authors propose two effective remedies: refining server error messages to specify actionable tools and pre-prompting agents to filter out unexecutable instructions before execution.
Sources coveringarXiv, LessWrong, Cybersecurity News, Latent Space
What this isA model's reading of the article and related coverage, written for aiqbench. Not the publisher's words.

MCP Error Messages Written for Developers Hurt the Most Capable Agents Most

arXiv3 min read

arXiv:2609.35381v1 Announce Type: cross Abstract: Many Model Context Protocol (MCP) servers wrap web APIs built for human developers, and their error messages tell the reader to run a command, edit a configuration, open a web page or wait. Many agents that read them can only call the server's tools. In 150 widely used MCP servers, 949 of 3,001 error messages tell the caller what to do next, and half of these steps depend on something the server cannot see about the caller. On credential errors, 62 of 67 steps ask for a terminal command, a configuration change or a web page; on rate limits, 20 of 30 say to wait and retry without naming the call to repeat. We tested five OpenAI models that act only through the tools of Berkeley Function Calling Leaderboard tasks, and the agents did what the step said. On expired credentials, a terminal command in the step left 45% of tasks recovered, and the loss it caused grew from 18 points for GPT-5.5 to 69 for GPT-6 Astra. On a rate limit, GitHub's "Wait before retrying." left 6%. We tested two remedies. For MCP developers, naming a server tool in the step raised recovery on expired credentials to 84%, with the login tool in place of the command, and on a rate limit to 88%, with the call to repeat in place of the bare wait. For agent developers, deleting the step with a one-sentence prompt before the model reads it raised recovery on expired credentials to 82%.

Abstract:Many Model Context Protocol (MCP) servers wrap web APIs built for human developers, and their error messages tell the reader to run a command, edit a configuration, open a web page or wait. Many agents that read them can only call the server's tools. In 150 widely used MCP servers, 949 of 3,001 error messages tell the caller what to do next, and half of these steps depend on something the server cannot see about the caller. On credential errors, 62 of 67 steps ask for a terminal command, a configuration change or a web page; on rate limits, 20 of 30 say to wait and retry without naming the call to repeat. We tested five OpenAI models that act only through the tools of Berkeley Function Calling Leaderboard tasks, and the agents did what the step said. On expired credentials, a terminal command in the step left 45% of tasks recovered, and the loss it caused grew from 18 points for GPT-5.5 to 69 for GPT-6 Astra. On a rate limit, GitHub's "Wait before retrying." left 6%. We tested two remedies. For MCP developers, naming a server tool in the step raised recovery on expired credentials to 84%, with the login tool in place of the command, and on a rate limit to 88%, with the call to repeat in place of the bare wait. For agent developers, deleting the step with a one-sentence prompt before the model reads it raised recovery on expired credentials to 82%.

15 pages, 6 tables. Submitted to the Journal of Systems and Software. Data and code: this https URL

Software Engineering (cs.SE); Artificial Intelligence (cs.AI)

arXiv:2609.35381 [cs.SE]

(or arXiv:2609.35381v1 [cs.SE] for this version)

https://doi.org/10.48550/arXiv.2609.35381 Focus to learn more arXiv-issued DOI via DataCite (pending registration)

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.

Full text under the publisher's open licence · 363 words

Related coverage