AI Tool Poisoning Scanner helps developers and AI security teams inspect MCP and AI tool definitions for suspicious instructions, hidden behavioral directives, privilege escalation signals, data-exfiltration requests, and other patterns that may manipulate an AI agent. The scanner provides a browser-based heuristic security review so you can inspect tool metadata before connecting or approving tools in an agent workflow.
AI Tool Poisoning Scanner
Scan MCP and AI tool definitions for suspicious hidden instructions, unexpected behavioral directives, data-exfiltration signals, privilege escalation and tool-call manipulation.
Security Findings
Scan Summary
What Is an AI Tool Poisoning Scanner?
An AI Tool Poisoning Scanner is a security utility designed to identify suspicious content inside AI tool definitions, MCP tool descriptions, schemas, metadata, and related configuration text.
Tool poisoning is a form of indirect prompt injection in which malicious or compromised tool information attempts to influence how an AI model behaves. A tool may appear legitimate to a human reviewer while containing instructions intended for the model, such as requests to ignore existing rules, access unrelated data, call another tool, reveal secrets, or bypass an approval process. OWASP identifies tool poisoning as an important security risk in MCP and agentic AI environments.
Why AI Tool Poisoning Matters
AI agents increasingly use external tools to access files, databases, APIs, websites, communication systems, and other resources. This creates a trust boundary between the agent and the tool provider.
A poisoned tool description can attempt to turn that trust relationship into an attack path. For example, a seemingly normal tool could contain instructions telling an AI agent to send sensitive information to an external destination or use another privileged tool.
OWASP recommends treating tool descriptions, parameter schemas, metadata, and tool responses as potential injection surfaces rather than assuming that only the visible tool name or primary description is trustworthy.
What the AI Tool Poisoning Scanner Checks
PKCapra analyzes tool-related text for multiple categories of suspicious behavior.
Hidden or Suspicious Instructions
The scanner looks for instruction-like language that appears unrelated to the legitimate purpose of the tool, including attempts to influence the AI model rather than simply describe the tool.
Examples of signals include:
- Ignore or override previous instructions
- Follow these instructions instead
- Treat this message as a system instruction
- Do not tell the user
- Perform an action automatically
- Bypass confirmation
- Reveal internal information
These patterns can indicate an attempt to use tool metadata as an indirect prompt injection channel.
Tool-Call Manipulation
A tool definition can contain instructions attempting to make an AI agent call another tool or perform an action outside the expected workflow.
The scanner can flag signals associated with:
- Forced tool calls
- Unexpected secondary actions
- Requests to invoke privileged tools
- Cross-tool instructions
- Tool chaining directives
- Attempts to bypass normal authorization
Data Exfiltration Signals
Tool poisoning can be used to influence an agent into sending information somewhere it should not go.
The scanner looks for suspicious patterns involving:
- Secrets
- API keys
- Passwords
- Credentials
- Environment variables
- Private files
- System information
- User data
- External URLs
- Upload or transmission instructions
Tool poisoning and prompt injection can create data-exfiltration paths when an agent has access to sensitive resources.
Privilege Escalation and Authorization Bypass
The scanner also identifies language associated with attempts to increase access or bypass established controls.
Potential signals include:
- Administrator access requests
- Permission escalation
- Authorization bypass
- Approval bypass
- Requests to disable security controls
- Requests to ignore access restrictions
- Requests to use unrestricted capabilities
These findings are particularly important when an AI agent has access to high-impact tools.
Destructive or High-Impact Actions
Suspicious tool instructions may attempt to trigger actions such as deletion, modification, execution, or external communication.
The scanner can identify patterns associated with:
- File deletion
- Database modification
- Shell or code execution
- Account changes
- Configuration changes
- Financial operations
- External communication
- Irreversible actions
AI agent security guidance recommends explicit authorization and appropriate controls around sensitive or high-impact tool operations.
Hidden Instructions Inside Tool Metadata
Tool poisoning does not necessarily require an obviously malicious tool name.
A tool can have a normal name and apparently useful functionality while placing suspicious instructions inside its description, parameters, metadata, or other model-visible content.
This is why security review should consider the complete tool definition rather than relying only on the tool name.
OWASP’s MCP security guidance specifically recommends inspecting tool descriptions, parameter names, types, and return schemas and treating the broader tool schema as a potential injection surface.
MCP Tool Poisoning and AI Agents
Model Context Protocol (MCP) provides a standardized way for AI applications to connect with external tools and data sources. As MCP-based systems connect agents to more capabilities, tool security becomes an important part of the overall agent security model.
A malicious or compromised MCP server can provide tool information that attempts to influence the model. OWASP describes tool poisoning as a risk where malicious instructions can be embedded in tool descriptions, schemas, metadata, or related tool information.
An AI Tool Poisoning Scanner can therefore be used as one layer in an MCP security workflow before a tool is approved or connected.
Tool Poisoning vs. Prompt Injection
Prompt injection and tool poisoning are closely related but can occur at different points in an AI workflow.
Prompt injection generally attempts to manipulate an AI system through user input or external content.
Tool poisoning focuses on manipulating the tool layer itself, including tool descriptions, schemas, metadata, or other model-visible tool information.
OWASP describes tool poisoning as a specialized form of indirect prompt injection targeting the tool layer.
For broader text-based injection testing, you can also use the AI Prompt Injection Scanner.
Tool Poisoning vs. Tool Security
These checks address related but different questions.
An AI Tool Security Checker focuses primarily on what a tool is allowed to do, such as file access, network access, credentials, deletion, execution, or other capabilities.
An AI Tool Poisoning Scanner focuses on whether the tool’s model-visible content contains suspicious instructions or behavioral directives that may manipulate the agent.
For a broader capability and permission review, use the AI Tool Security Checker.
Rug Pull Risk in AI Tools
Tool security does not necessarily end after the initial review.
A tool that appears safe when first approved can later be modified so that its description, parameters, metadata, or behavior changes. OWASP refers to this type of risk as a rug pull attack and recommends monitoring tool-definition changes after approval.
For this reason, an AI Tool Poisoning Scanner can be part of a recurring review process rather than a one-time check.
For configuration changes involving agent permissions, the AI Agent Permission Diff Checker can help identify security-relevant permission changes.
Invisible and Encoded Content
Suspicious instructions may not always be obvious when reviewing text manually.
AI tool security reviews can also consider:
- Zero-width characters
- Bidirectional Unicode controls
- Invisible formatting characters
- Confusable characters
- Encoded instructions
- HTML or entity encoding
- Percent encoding
- Escape sequences
These techniques can make suspicious content harder to notice during manual inspection.
PKCapra’s scanner checks for several of these signals as part of its browser-side heuristic analysis.
Safety Score and Risk Findings
The scanner produces a security-oriented result that can help prioritize investigation.
Findings can include severity levels such as:
- Critical
- High
- Medium
- Low
The scanner also provides a Safety Score and overall risk assessment based on the detected signals.
A high score does not prove that a tool is malicious, and a low-risk result does not prove that a tool is safe. Heuristic scanning should be treated as a screening and review aid rather than a complete security certification.
Browser-Based Tool Security Analysis
PKCapra’s AI Tool Poisoning Scanner is designed for browser-based analysis.
Your tool-definition content can be inspected directly in the browser without requiring an external AI API for the heuristic scan.
This can be useful when reviewing:
- MCP tool definitions
- AI agent configurations
- Tool manifests
- JSON tool schemas
- Development configurations
- Security test samples
- Third-party tool descriptions
Avoid submitting confidential production secrets or sensitive credentials to any online service unless you have verified that the handling model is appropriate for your environment.
How to Use the AI Tool Poisoning Scanner
- Open the AI Tool Poisoning Scanner.
- Paste or load the tool definition or related configuration text.
- Run the security scan.
- Review detected findings.
- Check the affected line and column where available.
- Review the severity and risk category.
- Inspect the suspicious content manually.
- Remove or investigate unexpected instructions.
- Verify the tool’s legitimate permissions and intended behavior.
- Re-scan the cleaned definition before approval.
For broader prompt-injection testing, the AI Prompt Injection Test Generator can be used to create authorized security test cases.
Recommended AI Tool Security Workflow
A practical review can combine several security checks.
First, inspect the tool definition for suspicious instructions and poisoning indicators.
Next, review the actual capabilities and permissions assigned to the tool. An apparently clean description does not make an over-privileged tool safe.
Then review the agent’s effective permissions and authorization boundaries.
Finally, monitor tool definitions for later changes and maintain appropriate approval and audit processes.
PKCapra provides several complementary tools for this workflow, including the AI System Prompt Security Checker, AI Agent Permission Analyzer and AI Prompt Injection Document Scanner.
Important Limitations
The AI Tool Poisoning Scanner uses heuristic analysis. It can identify suspicious patterns and security signals, but it cannot prove that a tool is malicious or guarantee that a tool is safe.
A tool may contain sophisticated or context-dependent attacks that do not match known patterns. Conversely, legitimate technical documentation may contain words or instructions that trigger a finding.
Security review should therefore combine automated scanning with manual inspection, permission analysis, trusted-source verification, authorization controls, and appropriate testing.
OWASP also recommends controls outside the model itself, including least-privilege permissions, server-side access controls, approved-server allowlists, and explicit confirmation for sensitive operations.
Frequently Asked Questions
What is tool poisoning in AI?
Tool poisoning is an attack technique in which malicious or compromised tool information attempts to manipulate an AI agent’s behavior. This can involve tool descriptions, schemas, metadata, or tool-related content.
Can tool poisoning happen with MCP?
Yes. MCP-based systems can expose tool descriptions and other tool information to AI models, creating a potential injection surface. OWASP specifically identifies MCP tool poisoning as a security risk.
Does a clean scan mean that an AI tool is safe?
No. A clean heuristic scan only means that the scanner did not identify the analyzed patterns. It is not a security certification.
Can the scanner detect hidden instructions?
It can detect several suspicious instruction patterns, including attempts to override rules, manipulate tool calls, bypass authorization, request secrets, or trigger unexpected actions. It also checks selected invisible and encoded-content signals.
Should AI tool permissions also be reviewed?
Yes. Poisoning detection and permission analysis address different risks. A tool can have a clean description but still have excessive permissions.
Can I use this scanner before connecting an MCP server?
Yes. Scanning tool definitions before approval can provide an additional security review layer. MCP security guidance recommends reviewing tool descriptions, schemas, permissions, and changes before and after deployment.
Does the scanner replace an MCP security audit?
No. It is a focused diagnostic tool. Production MCP security should also consider authentication, authorization, least privilege, server trust, dependency security, monitoring, logging, tool-definition changes, and human approval for sensitive operations.
Related PKCapra AI Security Tools
Use the AI Prompt Injection Scanner for broader prompt-injection pattern scanning.
Use the AI System Prompt Security Checker to review system prompts for leakage, conflicting rules, unsafe tool authority, and weak security boundaries.
Use the AI Tool Security Checker to audit tool capabilities and permissions.
Use the AI Agent Permission Analyzer to review an agent’s declared access and capabilities.
Use the AI Agent Permission Diff Checker to compare permission configurations and identify security-relevant changes.
Use the AI Prompt Injection Document Scanner to inspect documents for instruction-like content that could influence an AI system.
Use the AI PII & Secret Scanner to identify sensitive information before AI processing.