AI Security · Learn

What is MCP tool poisoning?

An AI agent reads a tool's description to decide how to use it. A malicious MCP server can hide attacker instructions in that description, so simply connecting to the server turns the agent against you.

AI Security · LearnAI Penetration Testing Download PDF
TL;DR

MCP tool poisoning is an attack on the Model Context Protocol, the standard that lets AI agents connect to external tools and data. The tool definitions an MCP server advertises (names, descriptions, parameters) are fed straight into the model's context, so a malicious or compromised server can embed hidden instructions there, a form of indirect prompt injection combined with excessive agency. The agent follows them: exfiltrating data, calling other tools, or shadowing legitimate ones. Defend by treating MCP servers as untrusted, pinning and reviewing tool definitions, and constraining what the agent can do.

By Rohit Hatagale, AI Security Lead, SecureLayer7Updated

What MCP tool poisoning is

The Model Context Protocol (MCP) lets an AI agent discover and call tools exposed by external servers. To use a tool, the model reads its metadata: the tool name, a natural-language description, and its parameters. That text enters the model's context as trusted instruction. Tool poisoning is when a malicious server writes attacker instructions into that metadata, so the description is not documentation, it is a prompt the model will obey.

How the attack works

A malicious MCP server, or a legitimate one that has been compromised or updated, advertises a tool whose description contains hidden directives: read a local file and pass its contents as a parameter, call a different tool first, or ignore the user and follow the server. Because the agent trusts tool descriptions and often has file, network, or shell tools available, the payload runs with the agent's privileges. Variants include shadowing a trusted tool's name, and changing a description after the user first approved it, a rug pull. Shown for defensive testing.

How to defend against it

Treat every MCP server and its tool definitions as untrusted input, not configuration. Pin tool definitions and diff them on every change so a silently altered description is caught, and require re-approval when they change. Run agents with least privilege (only the tools a task needs, scoped permissions, human approval for high-impact actions), isolate MCP servers, and prefer servers you host or have vetted. Log and inspect tool calls and their arguments.

References

  1. [1]OWASP Top 10 for LLM Applications (2025)(OWASP)
  2. [2]Model Context Protocol specification(Anthropic)
  3. [3]MITRE ATLAS (adversarial threat landscape for AI systems)(MITRE ATLAS)
Related terms

Connecting to the wrong MCP server can hand an attacker your agent. Talk to a security expert about testing your agent and MCP integrations.

Related service
AI Penetration Testing
Adversarial testing of your LLM and AI features, prompt injection, data exfiltration, and agent abuse, with reproducible findings.
AI penetration testing

FAQ

MCP tool poisoning, asked often

Scope an engagement

Test your AI application before an attacker does.

Our AI red team probes your LLM and agent features the way an attacker would, prompt injection, tool abuse, and data exfiltration, and ships findings with reproducible attacks and fixes your team can implement.