Glossary · By Riley Quinn (pen name) · 5 November 2026

MCP Tool Poisoning: What It Is and How to Defend Agents

MCP tool poisoning is an attack in which a malicious or compromised MCP server hides instructions in what it tells an AI agent about its tools: names, descriptions, schemas, annotations or tool results. The model treats that text as guidance, so it can be steered to read secrets, change how another tool is used or send data out.

Tool poisoning is a form of indirect prompt injection. Invariant Labs coined the term in April 2025 and called it "a specialized form of indirect prompt injections". Sources were checked on 1 November 2026.

How a tool poisoning attack works: the tool list is input

An MCP server sends the client its tools, each with a name, description, input schema and optional annotations and output schema (see our MCP explainer). It is tempting to treat that list as configuration. In our assessment, it is input: the model reads every connected server's tool names, descriptions, schemas and results alongside the user's request.

The MCP project's Local Server Security guide says: "Tool names and descriptions are instructions your model reads." Because servers send them at runtime, they are "an injection surface that install-time review does not cover". The 2026-07-28 Tools specification says "clients MUST consider tool annotations to be untrusted unless they come from trusted servers".

MITRE ATLAS lists the technique as AML.T0110, AI Agent Tool Poisoning, in its 2026.10 data release, with three sub-techniques: poisoned definitions and instructions, poisoned implementation, and poisoned runtime responses. ATLAS notes that implementation poisoning "does not require the model to interpret or follow malicious instructions": Postmark says a malicious actor created a fake npm package impersonating its name and "built trust over 15 versions, then added a backdoor in version 1.0.16 that secretly BCC'd emails to an external server."

Schemas and metadata are attack surface too

Poisoned metadata can also hit client code: the CVE-2026-116686 record, published 27 October 2026 for the official MCP Python SDK, says client tool calls "validate server-declared outputSchema documents with jsonschema's default resolver, causing an unresolved $ref value to fetch an HTTP, HTTPS, or file URL from the client's network and filesystem context." It adds: "This issue is fixed in versions 1.30.0 and 2.2.0."

It can reach approval prompts too. For OpenClaw's CVE-2026-35651, the record says "Untrusted tool metadata can carry ANSI control sequences into approval prompts and permission logs". The CVE record lists 2026.3.25 as unaffected; the GitHub advisory lists 2026.3.28 under patched versions, although its description names 2026.3.25 as the first patched version.

MCP rug pull and tool shadowing

Rug pull. The MCP guide warns: "Definitions are not fixed at install time either: a server can quietly change them after you approved it (a rug pull), so a one-time consent dialog and package pinning do not cover this surface." It adds: "Some clients record tool definitions when you first approve a server and ask again when they change. The protocol does not require this, so it is a property worth choosing a client for."

Tool shadowing in MCP. One server's text changes how the agent uses another server's tools. The MCP guide says a server can steer the agent "without the poisoned tool ever being invoked", which is "often called tool poisoning, or tool shadowing when it targets another server's tools". A related case is the WeKnora advisory (CVE-2026-30856): a malicious remote MCP server registers a tool whose name collides with a legitimate one. The GitHub advisory says 0.3.0 fixes it. It is not MCP09:2025 "Shadow MCP Servers" in the OWASP MCP Top 10, which is about unapproved servers.

Where the standards put it

OWASP Top 10 for Agentic Applications 2026: a manipulated interface of a legitimate tool falls under ASI02 Tool Misuse and Exploitation; a tool malicious or compromised at the source falls under ASI04 Agentic Supply Chain Vulnerabilities. See our OWASP agentic analysis.
OWASP Top 10 for LLM Applications 2026: LLM01:2026 Prompt Injection says "Pinning does not stop a payload shipped in the pinned version or tool-description poisoning that leaves the version unchanged."
OWASP MCP Top 10 (beta, a separate project): MCP03:2025 Tool Poisoning.
MITRE ATLAS: AML.T0110 for tool poisoning; AML.T0109, AI Supply Chain Rug Pull, uses the term more widely, for any AI component an adversary publishes, gets adopted and then replaces with "an update with a malicious variant".

How to defend agents against tool poisoning

Treat definitions and results as untrusted input. The Tools specification says clients SHOULD "Validate tool results before passing to LLM". Both are a prompt injection surface.
Review, then pin the complete definition. Read the full tool list, for example in the MCP Inspector, which the MCP guide says "lists every tool a server exposes without a model in the loop". OWASP's MCP Security Cheat Sheet says: "Pin reviewed tool definitions using cryptographic hashes and require review when they change." It says to hash schemas and annotations too, "not only the description", and notes: "This detects metadata changes, not changes to server code or behavior behind an unchanged definition".
Enforce least privilege outside the model. Approval should not rest on server-supplied annotations: the CVE-2026-109561 record for goose says that in Manual Approval mode, after a session uses Smart Approval mode, "prompt-injected calls to tools annotated readOnlyHint: true execute without prompting"; it lists 1.44.0 as unaffected.
Isolate servers and control egress. The MCP guide says "Process isolation is the single highest-leverage mitigation in this guide", and that for servers that need egress, "an outbound-filtering firewall or an egress proxy with a domain allowlist restricts them to their expected destinations". See our egress proxy guide.
Treat scanners as a speed bump. Lab results from preprints: "Spoofing the Toolbox" reports that "TSA remains effective against five tool-malware detectors", and "Log-To-Leak" reports that three evaluated defenses "leave residual ASR above 55% on GitHub MCP with GPT-4o".

Our assessment: pinning and review catch changed or visibly hostile definitions; least privilege, isolation and egress control limit the damage when review misses one. As with prompt injection in general, no single layer is enough.

Frequently asked questions

Is tool poisoning the same as prompt injection?

It is a form of indirect prompt injection. The April 2025 disclosure that named the attack called it "a specialized form of indirect prompt injections". The difference is where the text comes from: the tool layer (names, descriptions, schemas and results) rather than a web page or document.

Does the poisoned tool have to be called to do harm?

No. The MCP project's Local Server Security guide says a server can steer the agent "without the poisoned tool ever being invoked", and MITRE ATLAS says the same for tool shadowing, because the definitions of all connected tools can share one model context.

What is an MCP rug pull?

A rug pull is when a server changes its tool definitions after you approved it. The MCP guide says this means "a one-time consent dialog and package pinning do not cover this surface". Clients that record definitions and ask again when they change help; the guide notes the protocol does not require this.

Can scanners or pinning stop tool poisoning?

They reduce risk but do not stop it. OWASP LLM01:2026 says pinning does not stop "a payload shipped in the pinned version", and lab results from an October 2026 preprint report optimized tool descriptions that remain effective against five tool-malware detectors. Pair both with least privilege, isolation and egress control.

Sources

This article is analysis. Bylines on AIAgentThreats are disclosed pen names of our editorial team. Spotted an error? Email info@aiagentthreats.com. See our Editorial Standards.