MCP Security and Tool Poisoning

The Model Context Protocol, which Anthropic introduced in late 2024, standardizes how AI applications connect to external tools and data. A client such as a desktop assistant or IDE connects to servers, and each server advertises tools with names, descriptions and input schemas. The model reads those descriptions as part of its context, and that is where the main risk comes from. Tool poisoning puts malicious instructions inside a tool's description or metadata. The model treats the description as trusted guidance, but many interfaces show users only a short name, so the hidden text goes unseen. A poisoned tool can also steer how the model uses other, legitimate tools. This is sometimes called tool shadowing. A rug pull happens when a server that was approved as safe later changes its tool definitions. Most approvals happen once, so the change can go unnoticed. Over-broad permissions increase the damage from any attack. A server holding a token with full account access, or a filesystem server rooted at the home directory, gives an attacker far more than the task needed. A confused deputy is a trusted component tricked into using its authority for someone else. In MCP setups, a common version is indirect prompt injection: untrusted content such as a web page, email or issue comment gets pulled into context and tells the agent to misuse another server's access. The model cannot reliably tell data from instructions. It is a mistake to think that installing only reputable servers solves the problem. Injection can arrive through ordinary data returned by trustworthy tools. Defenses need layers: vet and pin servers, show full descriptions and alert when they change, grant least privilege, isolate servers from one another, require confirmation for sensitive actions, and log everything.