Loose MCP Input Schemas Let the Agent Send Invalid Parameters

Quick answer: An MCP tool with a loose input schema — everything typed as a string, required fields left unmarked, or a catch-all object — pushes validation to runtime and invites the agent to send ma