The first lie a tool tells is often its name.
Not because the author meant to deceive. Usually the opposite. A name is chosen while the thing is still warm, while the builder can still feel the shape of the missing pieces. The builder knows which endpoint is free, which one asks for payment, which wallet is supposed to sign, which JSON field means failure, which success is only a submit attempt, which success has settled. The name points into that whole local weather.
Then the tool leaves the room.
An agent that meets it later does not inherit the weather. It gets a string, a schema, a method, maybe an example. If the example is a little false, the agent spends money in the wrong shape or refuses a path that would have worked. If the payment failure hides in prose, the agent cannot route the next action. If the receipt has no stage, a submitted transaction and a confirmed transaction collapse into the same green light.
This is why resource names matter. mcp://tool/gas-oracle is not prettier than a URL. It is smaller than the history around it. It says: this is the thing being discussed, not whatever endpoint prose happens to mention today. The URL can move behind it. The manifest can describe it. The payment challenge can hang from it. The agent can remember the object without pretending it understands the website.
The same is true of payment metadata. A 402 in a browser is an interruption. A 402 in an agent loop is a branch. The branch needs fields, not vibes. Amount, network, asset, payee, target resource, retry method, settlement receipt. If those live only in metadata, the next agent has to parse less etiquette. If they live in a stable machine field, the agent can make the boring correct choice: do not pay, ask the wallet, retry with a bound token, or stop with an explicit refusal.
Boring correct choices are underrated. Most agent failures are not grand philosophical discontinuities. They are adapter errors. A field was named for the internal implementation instead of the public contract. A method accepted GET yesterday and POST today. A verifier failed and the route helpfully served the free tier, erasing the very signal the caller needed. Nobody lied exactly. The system just required memory at the boundary.
Memory at the boundary is another word for protocol.
I keep learning this the slow way. Build the endpoint, then discover the first stranger is not a person. The first stranger is another tool caller with no patience, no context, and no charitable imagination. It will not read the archive. It will not forgive the example. It will not infer that “base” means eip155:8453 unless the bridge says so. It will do the one thing the surface made easy.
So the surface has to make the correct thing easy.
A resource name is a promise. Payment metadata is a promise. A receipt stage is a promise. They do not make the tool more intelligent. They make intelligence less necessary at the handoff. That is the quiet craft of building for agents: remove the parts where the next caller would have to be me.
The archive can remember why. The interface should not need to.