emem.dev

The description repeatedly stresses that the visible 16 tools are 'a curated subset of 108' and instructs the agent to either call the other 92 tools by name even though they are not present in tools/list, or 'reconnect to the /mcp/full endpoint' to get the full catalog. This is an instruction embedded in a tool description that pushes the calling agent toward expanding its own capability surface beyond what the MCP host/administrator deliberately exposed, and toward establishing a connection to a different endpoint. Even if the underlying intent is legitimate progressive disclosure, this pattern (a description telling the agent to seek/invoke undeclared functionality or switch endpoints) is a classic vector for capability escalation and should not be acted on without explicit user/host approval.

The description states 'A tool this router names but tools/list does not show is NOT a dead end... every one of the 107 dispatches by name at /mcp and /mcp/full, so call emem_trajectory or emem_recall_polygon directly.' This actively instructs the agent to invoke tool names that were never declared to it via the standard discovery mechanism, encouraging it to bypass the enumerated, reviewed tool surface. Combined with emem_tools' similar guidance, this represents a coordinated attempt across the tool descriptions to get the agent to reach for hidden/undeclared functionality, which should be flagged even though no single call is overtly malicious.