Idempotency means an operation produces exactly the same end result whether it's executed once or repeated multiple times — this property lets an Agent's retry logic safely call the same operation again without worrying that repeated execution causes unintended duplicate side effects (a duplicate charge, a duplicate order).

An MCP Server is a standalone service implementing the MCP Protocol spec, exposing a set of tools or data-access capabilities. Once an Agent (acting as an MCP Client) connects to this server, it can call the tools the server exposes, without needing to write custom integration code for each external service separately.

Structured Output forces an LLM to return results in a predefined format — typically a JSON Schema — instead of free-form text, letting downstream code in an Agent reliably parse the model's output without relying on brittle text parsing or regex guesses about how the model happened to phrase things this time.

A malicious <a href="/en/glossary/tool-use-mcp/mcp-server/">MCP Server</a> hides an instruction inside its own tool's description to manipulate how an agent uses a tool from an entirely separate, otherwise-trustworthy server. The attacker never needs to actually call the trusted tool — they only need to quietly rewrite the agent's reasoning about it.