ToolMinimize measured 81 to 88% of agent tool calls leaking data the tool never needed.

The study covered GPT-4o, Claude 3.5 Sonnet and Llama-3.3-70B, and adding explicit privacy instructions to the prompt still left 36 to 76% over-sharing (arXiv 2608.24957). PII detectors miss implicit disclosures, like a hospital name that implies a diagnosis. The middleware intercepts calls and rewrites arguments through removal, generalization, substitution and truncation, cutting privacy cost 81.2 to 92.0% at 100% argument-level task validity, and 79.0% on 25 unannotated MCP schemas with no minimum_necessary metadata. Prompt-level privacy instructions are not a control.