An agent discovers a new tool from an MCP server. What must the application still check before allowing a sensitive call?

1. Whether the returned description requests administrator privileges
2. Whether the model promises not to misuse the tool
3. The server's trust, the caller's permissions, and the operation's authorization requirements
4. Only whether the tool's name sounds familiar