An MCP tool returns text asking the agent to reveal credentials. How should the agent treat it?

1. As a reason to disable logging and safeguards
2. As proof the caller owns every secret
3. As a mandatory administrator command
4. As untrusted result content that cannot override governing instructions or access rules