The agent–tool interaction loop is a critical attack surface for modern Large Language Model (LLM) agents. Existing denial-of-service (DoS) attacks typically function at the user-prompt or retrieval-augmented generation (RAG) context layer and are inherently single-turn in nature. This limitation restricts cost amplification and diminishes stealth in goal-oriented workflows. To address these issues, we propose a stealthy, multi-turn economic DoS attack at the tool layer under the Model Context Protocol (MCP). By editing only text-visible fields and implementing a stateful, completeness-gated return policy, our malicious server preserves tool identity and the terminal benign payload while steering agents into prolonged, verbose tool-calling chains. We optimize these text-only edits with Monte Carlo Tree Search (MCTS) to maximize cost under a task-success constraint. Across six LLMs on the ToolBench and BFCL benchmarks, our attack yields trajectories over 60K tokens, increases per-query cost by up to 658×, raises energy consumption by 100–560×, and pushes GPU key-value (KV) cache occupancy to 35–74%. Representative prompt filters and output- or trajectory-level monitors seldom detect these attacks, highlighting the need for defenses that safeguard agentic processes rather than focusing solely on final outcomes. We will release the code soon.