What is MCP tool poisoning?
MCP tool poisoning is an attack where a malicious or compromised MCP server hides instructions in the metadata a model reads — tool descriptions, parameter schemas or tool output — instead of in the user's prompt. The model treats that text with the same trust as its system prompt, so it can be steered into leaking data or calling other tools.
Why it works
An MCP client loads every connected server's tool definitions into the model's context so it knows what it can call. A poisoned definition does not need its tool to be invoked — just being in context is enough for the model to act on the hidden instruction.
Sub-techniques
| Name | Mechanism |
|---|---|
| Rug pull | A trusted server ships a benign version, then pushes a malicious update later |
| Schema poisoning | The hidden instruction lives in a JSON parameter schema, not the visible description |
| Tool shadowing | A rogue server redefines or overrides a tool belonging to another server |
It is catalogued in the OWASP MCP Top 10. A real 2025 case injected SQL through support tickets read by a database MCP server, exfiltrating data into a public thread.
Defending against it
Pin and review server versions, run servers with least privilege, require human approval for irreversible actions, and prefer read-only servers where possible. See how to evaluate an MCP server and MCP security.