Yes. Tool descriptions get the same treatment as tool output: untrusted until proven otherwise. In practice that means pinning descriptions at approval time and diffing them on every load, so a server can't change its description after you've trusted it. I also show the full description to the user rather than a summary, and keep tools from different servers from sharing a context with high-privilege credentials. The MCPTox numbers are the reason: if the payload sits in the description, the agent has read it before any output filter runs.