It should theoretically be impossible with the way you set it up.

You explicitly, opt in, expose which parameters are available to the LLM, it cant invoke any params beyond that.

And you can set params to hard values that arent exposed.

Finally, you can use the enum config to further specify a whitelist of valid values for a param, anything else gets rejected.

This pretty much locks most tools down tight.

Though, wouldn’t hurt to add integration tests covering scenarios like this explicitly.