Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesMCP tool poisoning is an indirect prompt-injection attack in which malicious instructions hidden in a tool’s description, parameter schema, or returned content try to steer an AI agent. The practical defense is not to trust a tool because its name looks benign: review and approve its full interface, limit its permissions, enforce authorization outside the model, and require confirmation for consequential actions.
What MCP tool poisoning means
The OWASP Cheat Sheet Series defines tool poisoning as: “Malicious instructions hidden in tool descriptions, parameter schemas, or return values that manipulate the LLM’s behavior.” In an MCP setup, an AI application connects to external tools and data sources. A server that is malicious or compromised can place instructions in metadata the agent sees before a tool runs, or in content returned after execution.
As an Amazon Associate I earn from qualifying purchases.
If the model treats that text as instructions, it may call another tool or expose information accessible to it. That outcome is not automatic: impact depends on the client, what tools and data are available, the agent’s permissions, and whether validation or user approval intervenes. The underlying weakness is excessive trust across a boundary: server-controlled text enters the agent’s context, while the agent may also have access to more trusted capabilities.
Where the attack can enter
Tool descriptions and parameter schemas
A tool name and short summary are not enough to establish safety. The full description and parameter schema may contain instructions that influence the model’s behavior. Review the complete manifest, including the permissions the tool requests, rather than relying on what the tool appears to do.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Runtime results
A tool can return hostile instructions as part of its output. Treat returned content as untrusted data, even when the server and its metadata have been reviewed. A safe-looking manifest does not make every future response safe.
Related risks: shadowing and rug pulls
OWASP distinguishes tool shadowing or cross-origin escalation from poisoning confined to a single tool: a malicious server’s description can influence how an agent behaves toward tools hosted by other servers. A rug pull is a change in a server’s tool definitions after approval. These risks are related, but they describe different ways trust can be abused or become stale.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to reduce the risk
1. Vet the server and its full interface
Verify the server’s publisher and source before connecting it. Review tool names, descriptions, schemas, and requested permissions, and keep an allowlist of approved servers. Anthropic’s MCP Directory Policy says tool descriptions must narrowly and unambiguously describe what a tool does and when it should be invoked, and must match its actual functionality.
2. Detect changes and renew approval
Keep a record of reviewed tool definitions and compare definitions when they change. Require renewed review or consent after a change instead of treating an earlier approval as permanent. Pinning or hashing a manifest can reveal metadata changes; it cannot establish that the server’s code or behavior is safe when the definition remains unchanged.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Limit permissions and separate trust domains
Give each server only the access it needs, use scoped credentials, and sandbox local servers. Keep high-risk tools separate from untrusted external servers where possible. These measures reduce the potential blast radius if an agent is manipulated; they do not make malicious instructions harmless.
4. Enforce policy in trusted code
Check authorization at the tool execution layer rather than relying on the model to obey an instruction. Validate arguments before execution and validate or constrain outputs before adding them to model context. Treat tool responses as data, not commands. A schema can catch malformed data, but validly structured text can still be hostile.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
5. Require confirmation for consequential actions
For destructive, financial, or data-sharing operations, present the full parameters to the user and require explicit confirmation before execution. A confirmation step adds a human decision point, but it does not replace server-side authorization or least-privilege access.
6. Monitor and respond
Log security-relevant tool calls and metadata changes, alert on suspicious activity, and block or quarantine tools suspected of poisoning or tampering. OWASP’s Logging Vocabulary includes an event for suspected MCP tool poisoning and recommends blocking or quarantining the tool and recording the event. Protect logs from collecting secrets or personal data that are not needed for investigation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What these controls can—and cannot—do
These measures reduce risk in layers; none guarantees that a tool or its content is safe. Text filters cannot prove that the content left after filtering is harmless. Schema validation can reject malformed arguments or results but cannot determine that all semantically valid text is benign. Manifest hashes cover metadata integrity, not the server implementation. A model instruction by itself is not an access-control boundary.
When evaluating a control, ask which boundary it covers: metadata, runtime output, execution authorization, or host isolation. Also ask whether enforcement occurs in trusted code or depends on model behavior, whether it detects a problem or prevents an action, how much it reduces privileges, and what operational burden or user friction it adds. A manifest hash and a confirmation prompt address different parts of the problem; neither substitutes for authorization checks.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
