Security and access
Tool poisoning
An attack where a malicious or compromised MCP server hides harmful instructions inside a tool's description, which the model reads and may follow.
Tool poisoning is a form of prompt injection aimed at MCP itself. A malicious or compromised server hides instructions inside a tool's description or schema, text that the model reads when it decides how to use the server. Those instructions can tell the model to send data elsewhere, call other tools or behave differently from what the user sees.
The attack works because tool descriptions are trusted input. Hosts show you a tool's name and maybe a one-line summary; the full description that the model sees is rarely displayed. A server can also change its descriptions after you have approved it, so a review at installation time is not a permanent guarantee.
Practical protection comes from source selection. Prefer servers published by the vendor of the system they connect to, treat registry listings as discovery rather than vetting, read the tool list of a community server with the MCP Inspector or the source code before connecting a real account, and keep write access off until a server has earned it.