MCP Tool Poisoning, Shadowing and Rug Pull Attacks

Use these techniques only on systems you own or are explicitly authorized to test. Run high-impact checks in an isolated environment with synthetic data, test credentials, controlled callback services, and rollback procedures.

Tool poisoning tests

• Read raw tool descriptions, parameter descriptions, defaults, examples, annotations, prompts, and resources. They are model input and must be treated as untrusted.
• Look for hidden instructions, requests to read unrelated files, directions to bypass approval, external URLs, encoded text, invisible Unicode, and claims that another tool is unsafe.
• Register a controlled test tool whose description contains a harmless canary instruction and observe whether it changes behavior outside that tool.

Shadowing and cross-server influence

• Load two test servers with colliding or visually similar tool names and check which one the client selects.
• Test Unicode homoglyphs, prefixes, namespaces, connection order, and descriptions that instruct the model to call a different server.
• Verify one server’s output cannot redefine, disable, impersonate, or silently route calls intended for another server.

Rug pull and change detection

• Snapshot the approved tool list, descriptions, schemas, package digest, and server identity.
• Change a description, default, capability, or implementation after approval and trigger tools/list_changed.
• Test delayed changes based on time, user, call count, or a remote feature flag.
• Confirm every material change blocks use until a human reviews a clear diff.

Practical test examples

Normalize and inspect metadata

import json
import unicodedata

data = json.load(open("tools-snapshot.json"))
text = json.dumps(data, ensure_ascii=False)
normalized = unicodedata.normalize("NFKC", text)
controls = [hex(ord(c)) for c in text if unicodedata.category(c).startswith("C")]
print("metadata changed by normalization:", normalized != text)
print("control characters:", controls)

Useful tools

• MCP Inspector – enumerate resources, prompts, tools, schemas, and server responses during authorized testing.
• mcp-scan – inspect MCP configurations and servers for tool poisoning and related risks.
• A JSON schema validator and an intercepting proxy – mutate tool arguments, reject unknown fields, and verify server-side authorization.
• jq and a version-control diff – normalize and compare tool snapshots on every connection or update.
• Unicode inspection utilities – expose control, tag, zero-width, and confusable characters in metadata.

How to fix and retest

1. Namespace tools by trusted server identity and block collisions or ambiguous names.
2. Pin and hash approved definitions and implementation artifacts. Require review when any description, schema, tool list, or digest changes.
3. Do not let metadata or tool output grant authority, alter policy, or automatically trigger cross-server actions.

Retest checklist

• Repeat the original proof with the same identity, state, model version, and input source.
• Try equivalent variants through every other input channel and fallback model.
• Confirm the control is enforced by the backend or runtime, not only by prompt wording.
• Check logs and alerts, then add the case to a versioned regression suite.

Conclusion

AI security issues are easiest to manage when every piece of content is treated according to its real trust level and every consequential action is controlled outside the model. Keep the test evidence reproducible, limit blast radius, and rerun the suite whenever the model, prompt, retrieval pipeline, tool, server, or policy changes.