The dependency must be enforced by orchestration rather than left to probabilistic tool selection. Anthropic documents that tool_choice: {"type": "tool", "name": "..."} forces Claude to invoke the specified tool. By contrast, auto allows Claude to decide whether and which tool to call, while any requires some tool but does not force a particular one. ( https://platform.claude.com/docs/en/agents-and-tools/tool-use/define-tools ) Option A therefore establishes a deterministic two-stage workflow. The first API turn forces extract_metadata
, producing the DOI and other structured paper details. The application validates and stores that result. A subsequent turn then exposes or permits verify_doi and lookup_citations , passing the extracted DOI as explicit state. This design converts an implicit tool dependency into an application-controlled execution graph.
Option B is incorrect because array order is not a documented precedence mechanism and cannot guarantee selection. Option C forces extract_metadata on every call, including turns where enrichment should occur, potentially creating an infinite or non-progressing workflow. Option D guarantees only that one available tool is called; Claude could still select lookup_citations before the DOI exists.
For stronger input integrity, the tools can also use strict schemas so their arguments conform to the declared JSON Schema. The sequencing requirement, however, remains the responsibility of the orchestration layer.
Official references/topics: Tool Choice; Forced Tool Invocation; Multi-Turn Tool Orchestration; Tool Dependency Management.

Option C identifies the architectural contradiction. A specialized subagent's role prompt says what work it should perform, but granting it every tool simultaneously signals that unrelated actions are available and potentially legitimate. The synthesis agent can therefore interpret web search as a permissible way to fill gaps, while the report generator may invoke document-analysis tools even though those responsibilities belong elsewhere. Anthropic's Agent SDK documentation describes subagents as focused workers with tailored instructions and explicitly supports restricting each subagent to specific tools; it notes that tool restrictions reduce unintended actions. There is no documented universal threshold at which choosing among 18 tools becomes unreliable, so option B invents a "four or five tools" limit. Context consumption in option A may affect efficiency, but it does not directly explain the role-specific cross-calling pattern. Option D is also incorrect because the observed behavior occurs after delegation, inside agents that already possess the tools.
The remedy is least-capability configuration: give the web agent search tools, the document agent document tools, the synthesis agent only the inputs and utilities required to combine findings, and the report agent formatting or file-output tools. Aligning role, description, and tool allowlist removes the conflicting affordances.

Option B preserves provenance as structured data throughout every handoff. Each finding should include the summarized claim and an associated source record containing its URL or document identifier, page or section location, relevant excerpt, and possibly retrieval date and confidence. The synthesis agent can combine claims without destroying this relationship, and the report generator can produce citations deterministically.
Anthropic's multi-agent research system retains findings until a dedicated citation stage identifies the precise source locations supporting report claims. This demonstrates that citation provenance must remain available beyond initial retrieval and summarization.
Option A attempts to reconstruct provenance after it has been discarded, which is expensive and may associate a claim with a different or weaker source. Option C preserves evidence but wastes context by transferring approximately all raw search and document content. Option D is better than losing references entirely, but embedding citations only in prose makes programmatic validation, deduplication, and claim-to- source mapping less reliable. Structured content and source fields maintain both context efficiency and auditable attribution while allowing different agents to transform the narrative safely.

Option A corrects the missing tool contract that permits Claude to guess a required parameter. The process_refund description should state its prerequisite explicitly: invoke lookup_order, use only the exact order_id returned by that successful call, and ask for additional identifying information when lookup cannot resolve an order. An input example can demonstrate the correct two-tool sequence.
Anthropic's tool-definition guidance identifies detailed descriptions as the most important factor in tool performance. Descriptions should explain when a tool should and should not be used, what every parameter means, and all important limitations. The tool-use overview confirms that Claude selects and populates tools based on the request and their descriptions.
Option B forces some tool call but does not tell Claude which tool must run first or where the identifier originates. Option C is an essential defence-in-depth control, but it detects the fabricated value after Claude has already made the incorrect decision. Option D works only when the customer supplies an identifier and does not cover "recent purchase." Explicit prerequisite and provenance instructions directly prevent the model from inventing the required argument.

Option A follows the MCP error contract. An error originating during execution of a valid tool call-such as an API failure, input-validation problem, or business-logic failure-should be returned inside the tool result with isError: true. The content should explain what happened and, where possible, provide actionable recovery guidance.
The official MCP tools specification distinguishes tool-execution errors from protocol-level errors and specifies that execution failures are reported through tool results using isError: true. Anthropic's tool-using agent tutorial provides the equivalent Claude API pattern using is_error: true, allowing Claude to retry with corrected input, request clarification, or explain the limitation.
Option B falsely represents a failed operation as successful, weakening reliable failure detection. Option C deprives the agent of the information required to determine an appropriate recovery action. Option D may be converted into a tool error by some SDK runners, but uncaught exceptions are not the MCP-level response contract. The strongest implementation returns a concise, sanitized, actionable error result and separately records detailed diagnostics in server logs.