Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
The authors audited 3,001 error messages across 150 Model Context Protocol (MCP) servers and evaluated how human-targeted remediation advice impacts autonomous tool-use agents across Berkeley Function Calling Leaderboard tasks. Because instruction-following agents literally attempt prescribed human actions—such as running terminal commands or opening browser pages outside their tool scope—developer-centric error strings severely impair agentic recovery loops. Crucially, this effect penalizes capable models most severely (inducing a 69-point task recovery drop in GPT-6 Astra compared to 18 points in GPT-5.5), though rewriting errors to explicitly name accessible server tools or stripping remediation text via system prompts restores recovery rates above 80%.
Smarter agents fail harder when reading human-facing MCP error messages, blindly executing impossible developer commands to cause up to a 69-point collapse in task recovery.
Many Model Context Protocol (MCP) servers wrap web APIs built for human developers, and their error messages tell the reader to run a command, edit a configuration, open a web page or wait. Many agents that read them can only call the server's tools. In 150 widely used MCP servers, 949 of 3,001 error messages tell the caller what to do next, and half of these steps depend on something the server cannot see about the caller. On credential errors, 62 of 67 steps ask for a terminal command, a configuration change or a web page; on rate limits, 20 of 30 say to wait and retry without naming the call to repeat. We tested five OpenAI models that act only through the tools of Berkeley Function Calling Leaderboard tasks, and the agents did what the step said. On expired credentials, a terminal command in the step left 45% of tasks recovered, and the loss it caused grew from 18 points for GPT-5.5 to 69 for GPT-6 Astra. On a rate limit, GitHub's "Wait before retrying." left 6%. We tested two remedies. For MCP developers, naming a server tool in the step raised recovery on expired credentials to 84%, with the login tool in place of the command, and on a rate limit to 88%, with the call to repeat in place of the bare wait. For agent developers, deleting the step with a one-sentence prompt before the model reads it raised recovery on expired credentials to 82%.