Your AI Agent Thinks It Worked. Your Database Disagrees.

Somewhere in your agentic pipeline, a tool returned 200 OK — and still left your system in a state you never intended. This paper catalogs exactly how that happens, and the news is worse than “edge case.”

What happened

Trofimov and Novikov set out to map the failure modes that live specifically at the boundary between an agentic workflow and the external tools it calls. Their core observation: when agents operate under retries, speculative execution, concurrency, or partial failures, a successful tool call does not imply a consistent external state. They build a formal “effect-history model” that separates what actually happened in the world from what the agent runtime observed happening — a gap most builders treat as zero. From that model they derive a catalog of eight recurring external-effect anomalies (missing effects, duplicated effects, aborted effects that survive, committed effects that depend on later-withdrawn provisional state, and so on). They then ask whether the dominant shared tool interface — Model Context Protocol — can express the semantics needed to prevent any of these anomalies. To answer that, they measured annotation vocabulary usage across 98,291 tools exposed by registered MCP servers. Verdict: the fields are widely emitted, but provide only coarse call-level hints, and none of the four required boundary capabilities is fully expressible in the current standard. Tool use vs. function calling semantics, it turns out, were designed for the happy path.

Cold read

This is a taxonomic and measurement paper — not an experimental one. The authors catalog anomalies and show the interface is expressively insufficient; they do not show empirical rates at which these anomalies occur in real deployed systems. “None of the required capabilities is fully expressible” is a gap in the spec, not a demonstrated frequency of production failures — those could be rare, or developers could be papering over them with application-level hacks that mostly work. The 98,291-tool measurement tells you what annotations people emit, not whether the absence of richer semantics is actually causing business-visible data corruption anywhere. The paper also scopes to MCP specifically; other tool interfaces (OpenAI function calling schemas, custom orchestration layers) are not evaluated, so the finding is MCP-specific even if the underlying anomaly catalog is general. Finally, “reusable transactional contracts at the tool boundary” is the authors’ proposed solution direction — it is not built, not evaluated, and not standardized anywhere yet.

What it means for you

• Signal maturity: 3/5 — the problem diagnosis is rigorous; the solution is a research roadmap, not a product
• Who gets hurt: Founders running multi-agent orchestration over stateful external systems — payments, inventory, CRM writes, email sends — where duplicate or ghost effects have real dollar cost
• What breaks if this is true: Any “agent does the work, human reviews later” workflow that assumes tool-call success equals consistent world state is silently accumulating anomalies; your reconciliation cost is hiding in ops, not in your LLM bill
• Why it might not land: Most teams operating at non-hyperscale volume can catch these failures with idempotency keys, dead-letter queues, and application-level saga patterns — messy, but it works well enough to ship
• Watch for: MCP specification working group proposals for transactional annotations or effect-type metadata; if that surfaces in 2027 it validates the paper’s entire framing

Forecast as of 2026-09-15

By Q3 2027, at least one high-profile agentic-workflow incident (publicly disclosed data duplication or financial reconciliation failure attributable to agent retry behavior) will accelerate adoption of idempotency or compensation metadata in a major tool-calling standard — but MCP’s core schema will still not have a ratified transactional contract layer by that date.

Source: When Tool Calls Succeed but Workflows Fail: Anomalies at the Agent-Tool Boundary — Artem Trofimov, Boris Novikov. https://arxiv.org/abs/2609.15397v1