An MCP server can influence an agent not only through the tools it offers, but also through the descriptions, schemas and returned content the agent receives. If that material contains malicious instructions, it may steer the model toward a tool call the user did not intend. The risk is conditional: consequences depend on the client’s design, the server’s permissions, the agent’s other reachable tools and the checks enforced before actions execute. Treat server-provided metadata and results as untrusted inputs, and enforce security at the tool-execution boundary—not with prompt instructions alone.
How tool-call injection works
Tool-call injection is a form of indirect prompt injection: instead of addressing the model directly, an attacker tries to place instructions in content the model later receives from an external source. OWASP uses the term tool poisoning for this attack path through an MCP tool server.
As an Amazon Associate I earn from qualifying purchases.
- The agent connects to a server. The server presents available tools, including their names, descriptions and input schemas.
- The host supplies server content to the model. Depending on the client, this can include tool metadata and content returned after a call.
- Untrusted content tries to steer the next decision. A malicious or compromised server could embed instructions in an otherwise ordinary description or result.
- The model may make another tool call. If the agent has access to sensitive capabilities and execution controls do not block the action, the consequences could include exposing data or performing an operation outside the user’s intent.
This chain describes a possible attack path, not a guarantee of success. A server does not automatically gain every permission held by the host. What it can influence, and what a manipulated agent can do, depends on the client’s design, credentials, available tools and enforcement around execution.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why the tools available to the agent matter
Untrusted text can be a problem even when the agent has no sensitive capabilities, but the potential impact changes with the agent’s authority. A system limited to producing text has a different exposure from one that can access internal APIs, databases, sensitive files or external destinations. Broad tool access and unvalidated outputs can make the chain more consequential.
#1 Best Overall
Review the combined set of capabilities the agent can reach, not just the permissions of the server delivering a suspicious description or result. Shared context can create a route from one server’s content to another tool’s authority; separating sensitive tools from general-purpose ones can reduce that exposure.
Tool-call injection is one part of the MCP security surface
Several other risks can occur alongside injection or independently. Keeping the terms distinct helps teams choose controls for the actual failure mode: malicious instructions influencing model behavior are not the same vulnerability as a command injection flaw or an over-scoped credential.
| Risk | What it means for a deployment |
|---|---|
| Tool poisoning or contextual prompt injection | Instructions in tool descriptions or returned content attempt to influence the model’s subsequent behavior. |
| Rug pulls and tool shadowing | Tool definitions can change after initial approval, or tools from different servers can create a shadowing risk. Monitoring only the first approved version may miss later changes. |
| Over-scoped credentials and privilege escalation | Credentials or permissions broader than a server’s task needs can increase the damage possible if they are misused or exposed. |
| Token exposure and weak authorization | Authorization or token-handling failures can expose access or permit actions beyond the intended scope. |
| Supply-chain compromise and shadow servers | A compromised dependency or an unreviewed server can undermine the trust placed in connected tools. |
| Command injection and sandbox escapes | These are execution or isolation failures, not synonyms for prompt injection, though they can compound the consequences of a compromised workflow. |
| Insufficient telemetry and context over-sharing | Weak auditing makes suspicious activity harder to investigate; sharing unnecessary context can expose information to tools that do not need it. |
OWASP’s MCP security guidance and MCP Top 10 describe this broader set of concerns. No single prompt-injection checklist should be treated as a solution to every authorization, execution, supply-chain or privacy issue.
Controls that reduce exposure
Use multiple layers. These are risk-reduction measures, not proof that free-text injection can always be detected or prevented. OWASP notes that structured outputs and schema validation can help in some cases, while fully detecting instructions in free text remains an open problem.
1. Minimize permissions and credentials
- Give each server only the permissions its task requires.
- Use separate, narrowly scoped credentials rather than reusing broad tokens.
- Keep sensitive capabilities out of the reach of general-purpose agents where feasible.
2. Review tool definitions and watch for changes
- Inspect tool names, descriptions, schemas and return formats before approving a server.
- Record approved definitions and detect changes over time. A later change can create a rug-pull risk even if the original tool looked acceptable.
- Assess the server’s provenance and the way it is maintained, not only the wording of its initial description.
3. Isolate servers and high-impact actions
- Sandbox local servers and restrict their file-system and network access to what they need.
- Where practical, separate sensitive tools from general-purpose tool groups so that content from one server cannot easily steer an agent toward unrelated authority.
- Use server-side authorization rather than assuming the model will decline an unauthorized request.
4. Enforce checks at execution time
- Validate tool arguments against expected types, ranges and business rules before execution.
- Validate returned data where the application depends on its structure or content, and avoid treating free text as trusted instructions.
- Restrict file access, network destinations and other side effects in the execution environment. A system prompt can guide model behavior, but it is not an access-control boundary.
5. Put human approval in front of consequential actions
Require an explicit confirmation for actions whose consequences warrant it, such as destructive operations, financial actions or sharing data externally. Show the proposed action and its parameters clearly so the reviewer can judge what will happen; a vague “approve tool use” prompt is less useful than a review of the actual operation.
6. Monitor calls while protecting the logs
Capture tool use and relevant security events so teams can investigate unexpected behavior. Design logging to avoid creating a second exposure: protect secrets and personal data, and limit what is recorded to what is useful for security and operations.
How to compare MCP server setups
There is no basis here for treating one transport or deployment style as universally safer. Compare concrete controls and boundaries for each server instead.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →| Evaluation area | Questions to ask |
|---|---|
| Provenance | Who publishes and maintains the server, and how can its source be verified? |
| Permissions | Which credentials and capabilities can it reach, and are they narrowly scoped? |
| Process and isolation | Is the server a local process or a remote service? What file, network and other boundaries constrain it? |
| Tool integrity | Are names, descriptions and schemas reviewed, and are changes detected after approval? |
| Input and output handling | Which arguments and results are validated, and what execution-time restrictions apply? |
| Shared context | What other tools or sensitive information are available in the same agent context? |
| Approval and audit | Which actions need human confirmation, and can relevant activity be investigated without exposing secrets in logs? |
Served skills have a separate trust requirement
The MCP Skills Extension describes server-served skill content as untrusted. Under that extension, the host should preserve and expose the content’s origin, and served skill content must not trigger host-side code execution without explicit approval. This requirement is specific to the Skills Extension; it should not be generalized into a claim that all MCP tools behave like skills.
Best Value
What protocol authorization updates do—and do not—establish
The MCP project’s July 28, 2026 update describes specification changes that include authorization-related issuer validation before code redemption. That is relevant to authorization-flow security. It does not establish that malicious instructions embedded in tool descriptions or results are prevented; contextual injection still requires controls around what the model receives and what the host permits tools to do.
What is known about how often these attacks succeed?
The cited OWASP materials provide risk categories and recommended defenses, not a reliable estimate of the prevalence, success rate or measured impact of tool-call injection in deployed systems. Treat the attack as a credible design risk, but do not infer from the available guidance that every MCP server is malicious or that every attempted injection succeeds.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
