The worst agent mistakes I've seen were my tool's fault, not the model's

I run an MCP server that agents use to read blockchain data. Every time an agent got something badly wrong, I went looking for the model's mistake and found mine instead. - My tool said a deposit could be paid one of two ways: 10 of one coin, or 174,276 of another. Like a menu saying "coffee or tea". The agent told the user the deposit was both, added together. - I put step-by-step instructions in the tool's answer. The agent handed the tool call to a helper agent, so the main agent, the one actually doing the job, never saw them. - My tool does one step for the agent: it fetches a signature from a server. Agents assumed it would also do the next step and claim the reward for them. It doesn't. The agent has to do that itself. Each time the fix was in the tool, not the prompt. The model believed exactly what my tool told it, or what it could reasonably read into it. Where do you draw the line between a model mistake and a tool mistake?