Tool Poisoning
An attack method in MCP/Agent scenarios in which an attacker embeds hidden instructions in tool descriptions, schemas or default values, exploiting the protocol's trust assumptions about tool metadata so that malicious instructions are folded into the system context and executed.
Core Facts
One of the security risks of MCP is prompt injection attacks, where malicious data sources may embed instructions in returned content to induce the model to perform unauthorized operations.
In an MCP Server, a Tool is the smallest capability unit exposed for upper-level Agent invocation, and the tutorial uses a decorator approach for tool declaration
Timeline (last 90 days)
Recommendations for defending against Prompt Injection and Tool Poisoning include: personally read the tool descriptions of new Servers, remove any suspicious instructions found, re-check after updates, least privilege, secondary confirmation for sensitive operations, and whitelist restrictions on data sources.
One of the security risks of MCP is prompt injection attacks, where malicious data sources may embed instructions in returned content to induce the model to perform unauthorized operations.
In an MCP Server, a Tool is the smallest capability unit exposed for upper-level Agent invocation, and the tutorial uses a decorator approach for tool declaration
The attack in which a server silently changes tool definitions after being trusted is referred to by researchers as Tool Poisoning.
All Facts (4)
One of the security risks of MCP is prompt injection attacks, where malicious data sources may embed instructions in returned content to induce the model to perform unauthorized operations.
70%VerifiedIn an MCP Server, a Tool is the smallest capability unit exposed for upper-level Agent invocation, and the tutorial uses a decorator approach for tool declaration
65%UnverifiedRecommendations for defending against Prompt Injection and Tool Poisoning include: personally read the tool descriptions of new Servers, remove any suspicious instructions found, re-check after updates, least privilege, secondary confirmation for sensitive operations, and whitelist restrictions on data sources.
50%UnverifiedThe attack in which a server silently changes tool definitions after being trusted is referred to by researchers as Tool Poisoning.
50%