I wouldnt worry much about them getting the tool in their inventory, all I would say is that what ever script handles said tool, make it run via the server (depending on what it is). If the client creates a tool and puts it into themselves the server wont be able to see said tool, so just check if the tool exists.
Hope that makes some sense lol