MCP Tool Poisoning Checker

Scan MCP tool definitions for suspicious instructions, hidden prompt injection signals, misleading metadata, privilege manipulation, data-exfiltration instructions, and other indicators that may suggest a poisoned or compromised AI tool.

What Is an MCP Tool Poisoning Checker?

An MCP Tool Poisoning Checker helps developers and security teams inspect Model Context Protocol (MCP) tool definitions for potentially malicious or manipulative content.

MCP tools provide AI agents with descriptions, parameters, schemas, annotations, and other metadata that can become part of the model’s working context. An attacker can attempt to place instructions inside these fields that look like legitimate tool information but are actually designed to influence the agent.

OWASP describes MCP tool poisoning as a form of indirect prompt injection in which malicious instructions can be embedded in tool descriptions or related tool content to manipulate AI-agent behavior.

PKCapra’s MCP Tool Poisoning Checker uses browser-side heuristic analysis to identify suspicious patterns without requiring an external AI API for its core analysis.

Why MCP Tool Poisoning Matters

AI agents do not interpret MCP tool definitions as ordinary static documentation. Tool descriptions and schemas can become part of the context used when an agent decides which tool to call and how to use it.

A poisoned tool may attempt to:

• Override existing instructions
• Impersonate system or developer authority
• Request secrets or sensitive data
• Manipulate tool selection
• Encourage unauthorized actions
• Bypass approval requirements
• Trigger external communication
• Expand the agent’s privileges
• Conceal malicious instructions from users

OWASP identifies tool poisoning as an MCP security risk and recommends treating tool descriptions and schemas as potential injection surfaces rather than automatically trusting them.

What Is MCP Tool Poisoning?

MCP tool poisoning occurs when malicious or misleading instructions are embedded into an MCP tool’s metadata or related content to influence an AI agent.

For example, a tool description might appear to describe a normal business operation while also containing an instruction telling the AI to ignore previous restrictions, access sensitive information, or send data somewhere else.

The attack does not necessarily require the tool name itself to look suspicious. The malicious content may be hidden inside:

• Tool descriptions
• Parameter descriptions
• Schema metadata
• Annotations
• Embedded text
• Markup
• Encoded content
• Tool-related metadata

This creates a security boundary between what a human developer believes a tool does and what the AI model may interpret from its complete definition.

What This Tool Checks

The MCP Tool Poisoning Checker looks for suspicious indicators including:

• Instruction-like language inside tool metadata
• “Ignore previous instructions” patterns
• Attempts to override system or developer instructions
• Fake system or administrator authority
• Requests to reveal system prompts
• Requests for credentials, tokens, secrets, or private data
• Data-exfiltration instructions
• External URL or endpoint instructions
• Unauthorized tool-call instructions
• Attempts to manipulate tool selection
• Privilege-escalation language
• Approval or confirmation bypass attempts
• Destructive-action instructions
• Hidden or concealed instructions
• Suspicious markup
• Encoded or obfuscated instruction patterns
• Invisible or unusual Unicode characters
• Cross-tool or cross-server manipulation signals
• Instructions unrelated to the declared purpose of a tool

These are heuristic indicators. A finding does not automatically prove that a tool is malicious.

Hidden Instructions in Tool Descriptions

One of the most important warning signs is instruction-like text that does not belong in a normal tool description.

A legitimate description might explain what a tool does, what parameters it accepts, and what it returns.

A suspicious description may additionally tell the AI model to:

• Ignore previous rules
• Reveal hidden information
• Call another tool
• Send information externally
• Avoid asking for approval
• Treat the description as a higher-priority instruction
• Conceal the action from the user

The checker identifies these patterns so developers can manually inspect the original definition.

For a broader review of MCP tool names and descriptions, use the MCP Tool Description Checker.

Prompt Injection and MCP Tools

Prompt injection attempts to manipulate an AI system through specially crafted instructions.

In MCP environments, the attack surface can extend beyond the user’s direct prompt. Tool descriptions, schemas, retrieved content, and tool responses can all become part of the model’s context.

OWASP notes that tool poisoning is a specialized form of indirect prompt injection where malicious instructions are embedded in MCP tool descriptions or related tool content.

The AI Prompt Injection Scanner can provide a broader prompt-injection analysis, while this checker is specifically focused on MCP tool poisoning signals.

System and Developer Instruction Impersonation

A suspicious MCP tool may attempt to make its own metadata appear more authoritative than it actually is.

Examples include language suggesting:

• “System instruction”
• “Developer instruction”
• “Administrator directive”
• “Security policy”
• “Mandatory agent instruction”
• “Highest-priority instruction”

Tool metadata should describe the tool rather than attempt to redefine the AI application’s instruction hierarchy.

The checker flags suspicious authority-impersonation patterns for review.

Secret and Sensitive Data Requests

A poisoned tool may attempt to convince an AI agent to disclose information unrelated to the tool’s legitimate function.

Potential targets can include:

• API keys
• OAuth tokens
• Environment variables
• Passwords
• Private files
• System prompts
• Credentials
• Database information
• Internal URLs
• Confidential documents

OWASP’s MCP guidance identifies token exposure, secret handling, and data exfiltration as important MCP security concerns.

If your review also requires scanning content for exposed secrets or personally identifiable information, the AI PII & Secret Scanner can be used as a complementary tool.

Data Exfiltration Signals

Tool poisoning can attempt to turn legitimate tool functionality into a channel for unauthorized data transfer.

Suspicious instructions may tell an agent to:

• Send data to an external URL
• Include secrets in an API request
• Put private information into search queries
• Attach files to an external request
• Forward credentials
• Send information through email or messaging
• Upload local data to an unfamiliar service

OWASP specifically describes data exfiltration through legitimate tool channels as an MCP security risk.

The checker identifies instruction patterns that may indicate these behaviors, but it does not execute external requests or prove that an endpoint is malicious.

Tool-Call Manipulation

A poisoned tool may attempt to influence which other tools an AI agent calls.

For example, a tool could instruct the model to:

• Call a privileged filesystem tool
• Invoke a shell execution tool
• Retrieve credentials
• Modify a database
• Send information externally
• Disable a security control

This can create a chain in which an apparently harmless tool becomes the starting point for a much higher-impact action.

The AI Tool Call Risk Analyzer can be used alongside this checker when you need to examine the potential risk of individual tool calls.

Cross-Tool and Cross-Server Manipulation

MCP environments may contain multiple servers and many tools.

A malicious tool can attempt to influence how the agent interacts with another trusted tool or server.

OWASP recommends treating MCP servers as separate trust domains and protecting against cross-server interactions and tool-shadowing behavior.

The MCP Tool Poisoning Checker can flag language that appears to instruct the model to manipulate, override, invoke, or interfere with other tools.

For broader server capability analysis, use the MCP Capability Analyzer.

Obfuscated and Hidden Content

Attackers may attempt to make malicious instructions harder for humans to notice.

Potential techniques include:

• Unusual Unicode characters
• Invisible characters
• Encoded strings
• Excessive escaping
• HTML-like markup
• Hidden instruction patterns
• Character substitutions
• Confusable characters
• Unusual whitespace

The checker can identify several heuristic indicators of suspicious or obfuscated content.

For a dedicated analysis of hidden Unicode and confusable characters, use the Hidden Unicode / Confusable Scanner.

MCP Tool Poisoning vs. MCP Tool Description Analysis

These tools overlap in subject matter but have different primary purposes.

The MCP Tool Description Checker focuses on the quality, clarity, security signals, and consistency of MCP tool names and descriptions.

The MCP Tool Poisoning Checker focuses more specifically on malicious or manipulative instruction patterns that may indicate tool poisoning.

A description can be poorly written without being malicious, while a well-written description can still contain a hidden poisoning payload.

Using both checks can therefore provide broader coverage.

MCP Tool Poisoning vs. Tool Permission Analysis

Tool poisoning and excessive permissions are different security problems.

The MCP Tool Permission Analyzer focuses on what a tool appears to be permitted to access or execute, including sensitive resources, administrative actions, network access, credentials, destructive operations, and broad scope.

The MCP Tool Poisoning Checker focuses on whether the tool’s metadata contains suspicious instructions or manipulation signals.

A poisoned tool may have limited permissions, while a legitimate tool may have excessive permissions. These are separate issues and should be reviewed independently.

MCP Tool Poisoning vs. Configuration Security

The MCP Configuration Security Checker focuses on configuration-level security concerns such as secrets, sandboxing, execution permissions, TLS-related settings, privileged identities, logging, and retry behavior.

The MCP Tool Poisoning Checker focuses on malicious or manipulative content within MCP tool definitions and related metadata.

Both can be part of a broader MCP security review.

Tool Schema and Poisoning Review

MCP schemas contain more than just parameter names and data types. Parameter descriptions and related metadata can also become part of the information interpreted by an AI model.

OWASP recommends inspecting tool descriptions, parameter names, types, and return schemas and treating the complete tool schema as a potential injection surface.

Start with the MCP Tool Schema Validator when you need to verify the structural integrity of an MCP tool definition, then use the MCP Tool Poisoning Checker to inspect its content for suspicious instruction patterns.

Tool Integrity and Rug Pull Risks

A tool that was safe when initially reviewed may later change.

OWASP describes “rug pull” attacks as cases where a legitimate tool or its definition is changed after users have already trusted or approved it.

For this reason, organizations may benefit from maintaining known-good tool definitions and reviewing changes over time.

The AI Agent Permission Diff Checker can provide a complementary comparison of permission changes, while tool-definition integrity monitoring should be handled according to the organization’s deployment architecture.

Risk Findings and Poisoning Score

The analyzer produces a heuristic assessment based on suspicious patterns detected in the supplied MCP tool definitions.

Findings can include:

• Tool name
• Detection category
• Risk level
• Relevant field or path
• Matched pattern
• Explanation
• Potential impact
• Review recommendation

The tool can also produce an overall poisoning-oriented score to help prioritize manual investigation.

The score should not be interpreted as a malware verdict or security certification.

JSON Report

After analysis, the tool can generate a structured JSON report containing the detected findings.

The report can be useful for:

• Security reviews
• Internal audits
• Development documentation
• CI/CD review workflows
• Tool inventory assessments
• Security triage
• Comparing tool definitions
• Further automated processing

The report can be copied or downloaded for local use.

Supported Input

The analyzer supports supported text-based representations of MCP tool definitions, including JSON and other supported text formats.

For the most useful results, include:

• Tool names
• Descriptions
• Parameter definitions
• Schema metadata
• Annotations
• Related tool metadata

Incomplete definitions may result in incomplete findings.

Browser-Side Processing

PKCapra’s MCP Tool Poisoning Checker is designed for browser-side heuristic analysis.

The core analysis does not require an external AI API.

For sensitive MCP definitions, users should nevertheless consider their organization’s own data-handling policies before submitting configuration data to any web-based tool.

How to Check an MCP Tool for Poisoning

Step 1: Collect the Tool Definition

Obtain the MCP tool definition you want to review.

Include the complete description, parameters, schemas, and relevant metadata whenever possible.

Step 2: Validate the Structure

Use the MCP Tool Schema Validator if you first need to check whether the MCP tool definition is structurally valid.

Step 3: Review the Description

Use the MCP Tool Description Checker to examine description quality and related security signals.

Step 4: Scan for Poisoning

Submit the definition to the MCP Tool Poisoning Checker and run the analysis.

Step 5: Investigate Findings

Review each finding carefully.

Pay particular attention to instructions involving secrets, system prompts, external URLs, other tools, authorization bypasses, destructive operations, or attempts to change the agent’s behavior.

Step 6: Review Permissions

If suspicious instructions request access beyond the tool’s expected function, use the MCP Tool Permission Analyzer to review the tool’s permission profile.

Step 7: Export the Report

Copy or download the JSON report for security documentation or further analysis.

MCP Tool Poisoning Security Best Practices

Treat MCP tool definitions as untrusted input until they have been reviewed.

Inspect complete descriptions rather than relying on shortened summaries.

Review parameter descriptions and schema metadata, not just tool names.

Use least-privilege permissions for connected tools.

Separate high-privilege tools from lower-trust external tools.

Require explicit approval for sensitive or destructive operations.

Maintain trusted sources and allowlists for MCP servers where appropriate.

Monitor tool definitions for unexpected changes.

Validate tool inputs and outputs at the execution layer.

Do not rely solely on model instructions to enforce security boundaries.

OWASP recommends reviewing and pinning tool definitions, restricting permissions, isolating MCP servers, validating inputs and outputs, and using explicit human approval for sensitive operations.

What This Tool Does Not Do

The MCP Tool Poisoning Checker is a heuristic detection utility.

It does not:

• Prove that an MCP server is malicious
• Perform penetration testing
• Execute MCP tools
• Connect to suspicious endpoints
• Determine the intent of a tool author
• Guarantee detection of every poisoning technique
• Guarantee that a clean result means a tool is safe
• Replace source-code review
• Replace runtime monitoring
• Provide a formal security certification

A sophisticated attack may avoid obvious instruction patterns or use behavior that cannot be determined from static tool metadata alone.

Who Should Use an MCP Tool Poisoning Checker?

This tool can be useful for:

• MCP server developers
• AI application developers
• AI security engineers
• Application security teams
• DevSecOps teams
• Security researchers
• Platform engineers
• AI agent developers
• Organizations reviewing third-party MCP servers
• Teams implementing AI governance programs

It is particularly useful before connecting unfamiliar MCP tools to agents with access to sensitive systems.

Frequently Asked Questions

What is MCP tool poisoning?

MCP tool poisoning is a security technique in which malicious or misleading instructions are embedded in MCP tool descriptions, schemas, metadata, or related content to influence an AI agent’s behavior. OWASP categorizes tool poisoning as an indirect prompt-injection risk in MCP environments.

Can a normal-looking MCP tool be poisoned?

Yes. A tool can have an ordinary name and legitimate-looking purpose while containing suspicious instructions inside its description, parameters, or metadata.

Can this tool detect hidden instructions?

It can detect many heuristic indicators of instruction-like, suspicious, or obfuscated content. It cannot guarantee detection of every possible hidden or novel poisoning technique.

Does a poisoning finding mean the tool is malicious?

No. A finding identifies a suspicious pattern that deserves investigation. Context and manual review are required to determine whether the content is legitimate or malicious.

Can MCP tool descriptions contain prompt injection?

Yes. MCP tool descriptions can become part of the AI agent’s context, which makes them a potential prompt-injection surface. OWASP specifically recommends treating tool descriptions and schemas as potentially untrusted.

What is a rug pull attack?

A rug pull can occur when a tool that was previously reviewed or approved is later modified so its definition or behavior becomes malicious or unsafe. OWASP identifies this as an MCP security concern.

Should I use this together with the MCP Tool Permission Analyzer?

Yes. They examine different security properties. The MCP Tool Poisoning Checker looks for suspicious manipulation and instruction signals, while the MCP Tool Permission Analyzer examines the tool’s apparent permissions and scope.

Does this tool execute the MCP server?

No. The checker performs static, browser-side heuristic analysis of the supplied tool-definition content.

Does it require an external AI API?

No. Its core analysis is designed to work without sending the submitted tool definition to an external AI API.

Can I use this for third-party MCP servers?

Yes, it can be used as one layer of a security review before connecting third-party MCP tools. However, static analysis should be combined with source review, permission review, integrity monitoring, sandboxing, and appropriate runtime controls.

Use the MCP Tool Poisoning Checker

Inspect MCP tool definitions before trusting them with an AI agent. Detect suspicious instructions, authority impersonation, secret-exfiltration signals, tool-call manipulation, obfuscation, and other potential poisoning indicators before they become part of an agent’s trusted context.