What is tool poisoning?

An attack that embeds malicious instructions in a tool's description or schema. The model reads and acts on them while the user sees only a harmless-looking tool name.

What is the lethal trifecta?

Access to private data, exposure to untrusted content, and a way to send data out. An agent with all three can be poisoned into reading secrets and exfiltrating them.

ModelRefs / MCP Security: Tool Poisoning Defense

MCP Security: Tool Poisoning Defense

Tool poisoning hides malicious instructions in an MCP tool's description. Learn the MCP attack classes and the defenses that stop them.

What this reference supports

MCP Security: Tool Poisoning Defense: This tutorial provides a structured implementation path with prerequisites, steps, checkpoints, and related references. Read the complete sequence before applying commands or configuration in production.

MCP Security: Tool Poisoning Defense: Adapt examples to the versions, security boundaries, data policy, and failure-handling requirements of your system. Validate intermediate outputs and keep a rollback path for changes that affect users or stored data.

MCP Security: Tool Poisoning Defense: Tutorial examples demonstrate a technique; they do not prove reliability, compliance, performance, or suitability for a workload. Use current primary documentation and test the final system under representative conditions.

Continue your research

Use these connected ModelRefs sections to compare alternatives, inspect implementation paths, and review the evidence and governance boundaries relevant to MCP Security: Tool Poisoning Defense.