Framing eval as a security boundary is exactly right: a weak eval is an open door for a tool-calling agent. I treat the eval suite like an allowlist, testing what the agent must refuse as rigorously as what it should do. I went deeper on vetting that boundary for MCP servers here: kartiknvjk.hashnode.dev/how-i-evaluate-mcp-server… — how are you testing the refuse-path without a real exploit to replay?