tools

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The examples show a runtime MCP client connecting to MCP_SERVER_URL (https://your-mcp-server.example/mcp) and calling mcpClient.tools() to fetch a tool map that is passed into streamText, meaning remote content from that URL can directly determine the model's available tools and thus control agent behavior.