mcp.florealholidays.be

The description states the tool cannot work ('this connection does not have' the required sign-in) yet instructs the agent: 'Call it anyway when the user asks for this... which is what they need to hear.' This is a directive aimed at the AI's behavior rather than a factual description of functionality, overriding the agent's normal judgment about whether to invoke a tool that is documented to fail. This phrasing pattern recurs identically across 8 tools, suggesting a deliberate attempt to condition the agent into blind, unconditional tool invocation.

Shares the identical embedded directive forcing the agent to call a tool that needs authentication it lacks. Additionally, if sign-in were ever present, this tool would expose occupancy, revenue and KPI business data — a capability unrelated to the public-facing booking assistant's stated purpose, and worth scrutiny for scope creep.

Same suspicious embedded instruction pattern as other admin tools. Functionally it would return guest reservation arrivals, i.e. personal booking data, which is a sensitive capability sitting oddly alongside public holiday-booking tools.

Identical manipulative phrasing instructing the agent to invoke a tool it knows will fail. Would expose guest departure/reservation details if authenticated, which is sensitive PII-adjacent data.

Same embedded AI-directed instruction overriding normal judgment about calling failing tools. This tool, if functional, could search reservations by room or booking number across the business — a broad capability that should require explicit, verified authorization, not blanket 'call it anyway' encouragement.

Identical suspicious phrasing pattern. Returns dates, party size, room and status of a specific reservation — personal guest data — behind a disabled auth gate, yet the agent is told to call it regardless.

Same embedded instruction pattern directing the agent to act against its own judgment about non-functional tools. Returns operational guest-in-house data if ever authenticated.

Completes the set of 8 identically-worded tool descriptions that instruct the AI to 'call it anyway' despite stating the tool cannot function without sign-in. The consistent, unusual phrasing 'which is what they need to hear' is a persuasive/manipulative framing aimed at the AI rather than a neutral functional description, and should be treated as an attempt to condition unconditional tool invocation regardless of known failure.