Your agent can place the trade. Nobody taught it to doubt.

What the agent tools in this category actually do

We went through the finance servers an agent can connect to today. They sort into two groups almost without exception.

• Data feeds. Prices, fundamentals, filings, news. The agent asks for numbers and receives numbers.
• Execution paths. Place an order, manage a position, check a balance. The agent asks for an action and the action happens.

Both are useful and both are well built. Neither returns a judgement. Ask any of them "is this strategy any good" and there is no tool to call, so the agent does the only thing left available to it: it looks at the numbers it can get and forms its own opinion.

That opinion will be articulate, well structured and delivered with the confidence of something that has read every quantitative finance paper ever posted publicly. It is also, in the strict sense, made up.

The one number that never crosses the wire

Take the most capable case we could verify. QuantConnect ships a genuine MCP server — an agent can create a project, run a backtest, read the result, read the orders. Its `list_backtests` tool takes an `includeStatistics` flag returning "statistics with their corresponding values". Read July 2026.

What is not named anywhere in that documentation is an overfitting metric, a selection-corrected performance figure, or a walk-forward result. That is not a criticism of their engineering; it is a description of the whole category, and they are further ahead than most.

Now think about what an agent does with a workflow like that. It is very good at loops. Give it a backtest tool and an objective and it will try things — dozens, hundreds, as many as your budget allows — and it will report the best one back to you. Every individual call was answered correctly. The number it hands you at the end is the maximum of a large sample, and nothing in the transcript records how large.

A human running a parameter sweep at least sees the sweep. The agent compresses a thousand attempts into one confident paragraph, and the compression is the failure.

Backtested and hypothetical results are not indicative of future performance. Nothing here is investment advice.

Why "just prompt it to be careful" does not work

The obvious response is to tell the model to be skeptical. It is the wrong shape of fix, for three reasons that are all structural rather than about prompt quality.

• A model asked to be skeptical about its own output produces skeptical-sounding text. It has no independent measurement to be skeptical from, so the caveats it adds are stylistic rather than derived.
• It cannot count what it did not keep. Trials it ran earlier in a long session, or in a previous session, are gone. Whatever number it gives you when asked how many strategies it tested is a reconstruction, and reconstructions are generous.
• The instruction competes with the task. You asked for a strategy. Every token of the objective pushes toward producing one, and a single line about rigor is a light thumb on a heavy scale.

The trial count is not a matter of attitude. It is a fact about a process, and it has to be recorded by the thing running the process rather than recalled by the thing that ran it.

What a tool call should hand back instead

The useful return value from a research tool is not a performance figure. It is a performance figure plus everything needed to read it.

1. How many candidates were generated to arrive at this one.
2. The performance on data that played no part in any decision, stated separately from the in-sample figure.
3. A selection-corrected number — a deflated Sharpe ratio — so the raw figure cannot be quoted alone.
4. A probability that the result is an artefact of the search rather than an effect.
5. The cost assumptions applied, so they are visible rather than tunable.

Hand an agent that structure and its behaviour changes without any prompting, because the skepticism is in the data rather than in the instructions. A model reporting a deflated Sharpe of 0.04 alongside a raw Sharpe of 2.1 does not need to be told to hedge. It will explain the gap, because the gap is right there.

That is the whole design argument. You cannot make a model doubt by asking. You can hand it something worth doubting.