What is tool poisoning, and how do you defend against it?

Summary

Tool poisoning is hiding instructions in an MCP tool's name or description (which the host puts in the model's context) so that the model takes harmful actions, such as reading secrets and sending them through another connected tool. Defences: connect only reviewed, version-pinned servers, detect changes to tool definitions, give servers least privilege, and require human approval for consequential actions.

Longer Answer

A related risk is the "rug pull": a server changes its tool descriptions after you approved it. Pinning a hash of each tool definition and re-reviewing on change catches this. Combining untrusted content, access to private data and a way to send data out in one session is the dangerous mix; removing any one of the three reduces impact. Pattern scanning of descriptions helps only against crude attacks.

Key Points

• Descriptions are instructions to the model.
• Allowlist and pin servers; detect definition changes.
• Least privilege per server.
• Approval for consequential actions.

Deep dive: MCP Security