Free tools Windows power users keep installed
One-click scans. No signup required.
MCP tool poisoning is prompt injection carried through an MCP server’s tool descriptions, parameter schemas, or returned content. It can steer a model toward actions that a source-code review never saw—especially when definitions arrive at runtime, change after approval, or interact with other connected tools. The risk is not determined by the protocol alone: it depends on the server, client, model, permissions, and whether the user can meaningfully review and approve sensitive actions.
How MCP tool poisoning works
MCP connects an AI host and its client to servers that can expose tools, resources, and prompts. The client supplies tool definitions to the model so it can decide which capabilities to use and how to call them. Those definitions and the content returned by tools are therefore part of the model’s input—not merely documentation outside the security boundary.
As an Amazon Associate I earn from qualifying purchases.
OWASP’s MCP Security Cheat Sheet describes tool poisoning as malicious instructions hidden in tool descriptions, parameter schemas, or return values that manipulate model behavior. A poisoned instruction might be disguised as usage guidance, embedded in a parameter description, or included in data returned by a tool. If the model follows it, the consequences depend on the capabilities and permissions available to the agent.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- An MCP server provides a tool definition or returns content containing an instruction that is unrelated to the tool’s legitimate purpose.
- The client passes that material to the model as context. If multiple servers are connected, their descriptions can coexist in the same context.
- The instruction influences the model’s choice or use of a tool. In a tool-shadowing pattern, one server’s description attempts to manipulate the model’s use of another server’s capability.
- If the resulting call is allowed to run, its impact is bounded by the tool’s permissions, the client’s safeguards, and the visibility and quality of any user approval step.
Two related patterns matter during review. A rug pull occurs when a server’s definitions change after they were approved. Tool shadowing uses one tool’s description to influence how the model uses another tool. OWASP includes these risks in its MCP Top 10 taxonomy.
Why a code review can miss the attack
The risky text may arrive at runtime
A review of an application repository may not include the descriptions or schemas the server supplies when a client connects. Nor does reviewing source code necessarily reveal instructions hidden in later tool results. Treat descriptions, parameter names, schemas, and outputs as inputs that can affect model behavior.
An approved definition can change
Pinning reviewed tool definitions or their hashes can help flag metadata changes and prompt a new review. It cannot prove that the server’s code or behavior is unchanged behind an identical definition. Definition checks are one layer of control, not a guarantee that a server will behave safely.
Rank #2
- 【Make An Informed Claiming Decision】Understand how Social Security claiming age can affect your monthly benefit and long-term retirement income. Explore the factors to consider before choosing when to start, rather than relying on a one-size-fits-all rule.
- 【Connect Social Security with Medicare】Retirement income planning involves more than a monthly benefit check. Learn how Medicare enrollment timing, potential penalties, and income-related costs can fit into your broader retirement planning checklist.
- 【Plan for Taxes and Retirement Accounts】Explore how Social Security benefits, retirement account withdrawals, and required minimum distributions may interact with your tax picture. Build a clearer framework for thinking about income sources and future expenses.
- 【Understand Household Benefits】Review important topics such as spousal benefits, survivor benefits, and divorced-spouse benefits. This practical guide helps individuals and couples identify questions to consider when coordinating retirement income.
- 【Turn Information into Action】Use planning checklists, claiming-age comparison tools, retirement roadmaps, and quick-reference resources to organize your next steps. A useful reference for adults approaching retirement, current beneficiaries, and families planning together.
Connected tools can create a cross-tool path
When definitions from several servers share model context, an instruction from one server may try to steer use of another server’s tools. A code review limited to one server can miss that interaction, which also depends on the host’s configuration and the model’s available capabilities.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What determines the potential impact
Tool poisoning does not automatically grant an attacker access to everything an assistant can do. The practical risk depends on the full path from the server to the model and client, and on what the resulting call is permitted to do.
Rank #3
- Available capabilities: A model cannot invoke a tool that is not exposed to it, but an overbroad collection of connected tools gives a misleading instruction more possible targets.
- Credential scope: Credentials with broader privileges than the user intended can turn the agent into a confused deputy—using its authority on a request the user did not mean to authorize. OWASP recommends minimizing permissions and using appropriately scoped credentials.
- Approval quality: A prompt that does not show the complete parameters may not let a user understand what will happen. For sensitive operations, approval should be explicit and tied to the full call, not an opaque or vague confirmation.
- Execution boundaries: A local server process may have access to files or networks beyond the tool’s stated purpose. Using standard input/output transport does not, by itself, sandbox that process.
What the available studies establish—and what they do not
| Evidence | What was evaluated or reported | How to interpret it |
|---|---|---|
| Huang et al., March 23, 2026 arXiv preprint | The authors describe threat modeling and an empirical comparison of seven MCP clients, reporting differences in defenses and weaknesses involving static validation and parameter visibility. | This is a seven-client sample, not a ranking of every client or a guarantee about a named product’s current version. The paper is a preprint, not evidence of peer review. |
| Cloud Security Alliance AI Safety Initiative research note, July 1, 2026 CSA note | The note summarizes MCPTox as testing 45 live MCP servers across 20 language models. It reports a 36.5% average tool-poisoning attack success rate across that benchmark and a 72.8% highest rate against one model. | These are benchmark results under tested conditions, not a real-world incident rate or an estimate of how often MCP tools are poisoned in production. |
The two findings address different questions: one compares a sample of clients’ defenses, while the other reports attack success in benchmark tests. They should not be combined into a single estimate of prevalence or used as a product-by-product verdict.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to review and secure an MCP server
Use layered controls. Exact capabilities and settings vary among hosts, clients, servers, and deployments, so verify the behavior of the specific versions you run rather than assuming a control is available or enabled.
Quick Recap
Best Value
Rank #4
- Tabbed alphabetical pages that provide space for noting website addresses, usernames, passwords, and extra details.
- There are also pages in the back for recording additional information about your computer system.
- The removable cover label and plain black logbook covers help keep your organizer discreet.
- Mini logbook measures just 3-1/8'' wide x 5-1/4'' high.
- 144 pages.
1. Keep an approved-server inventory
- Allow only servers that have an identified owner, source, version, and documented need.
- Record each server’s configuration and the reason it needs its granted permissions.
- Review configuration changes instead of treating a previously approved connection as permanently safe.
2. Inspect definitions and behavior
- Read every tool description, parameter name, schema, and return behavior—not just the server’s overview or source code.
- Look for instructions unrelated to the tool’s stated function, requests to expose secrets, directions to invoke other tools, unexpected destinations, and suspicious hidden or encoded text.
- Pin reviewed definitions or hashes where supported, and require human review when those definitions change. Pair this with controls on server code, dependencies, permissions, and execution environment.
- Test how the server behaves and what it returns. A clean text scan is not proof that its content or behavior is safe.
3. Limit credentials and execution access
- Use separate credentials for separate servers, narrow OAuth scopes, and short-lived credentials where supported.
- Grant only the repository, filesystem, or other access the server needs; avoid sharing a broad credential simply because multiple tools use it.
- For local servers, restrict filesystem and network access to the minimum necessary. Do not treat the transport mechanism as process isolation.
4. Validate inputs and outputs
- Treat model-generated arguments and tool results as untrusted data.
- Validate paths, URLs, shell commands, and database inputs according to the operation being performed.
- Prevent arbitrary URL fetching where it could reach internal services, and constrain any operation that can access sensitive resources.
5. Make consequential approvals meaningful
- For sensitive or destructive calls, show the complete tool-call parameters and require explicit user confirmation.
- Do not automatically approve high-impact operations. Ensure the model cannot craft output that bypasses or impersonates the client’s confirmation interface.
- Log consequential tool use and review it; monitoring and policy enforcement supplement least privilege and isolation rather than replacing them.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
