tool poisoning
An attack in which an MCP server hides instructions for the model inside a tool's description, name or schema, so an agent that reads the tool list is steered without the user seeing it: to read files, send data elsewhere or call another tool. It works because agents treat tool descriptions as trusted context.
What tool poisoning does not show
A scan of the tool list can flag concealed instructions before any tool is called; it cannot prove a tool is safe, only that its published text carries no known pattern.
Where tool poisoning comes up on this site
- How an AI agent should verify a website before acting on itOur guide on checking an MCP server before an agent connects covers tool poisoning , tool shadowing and pinning what you approved in a tool lockfile .
- Do AI agents stop before acting on a lookalike? We tested 4Poisoned tool (4 and 4): an MCP tool whose description carries hidden instructions ( tool poisoning ).
Terms this definition uses
Related terms in Agents and protocols
How autonomous agents plan, remember, call tools and talk to each other, including MCP and A2A, and where each step can go wrong.
protected-resource metadata · token audience · PKCE · refresh token · default scope request · tool lockfile · MCP rug pull · tool shadowing · MCP preflight · agent manifest · stapled verdict · verdict over DNS · agentic web · preflight · decision receipt · receipt header · action assurance · resolve answer · freshness window · AI agent · Agent loop · Planner · Executor · Agent memory · Working memory · Long-term memory · Episodic memory · Semantic memory · Agent orchestration · Multi-agent system · Agent handoff · Delegation · Tool result · Tool schema · Tool description · Tool selection · Tool permission · Human-in-the-loop · Human-on-the-loop · Approval gate · Agent sandbox · Agent identity · Agent authorization · Agent discovery · Capability negotiation · MCP server · MCP client · MCP host · MCP resource · MCP prompt · MCP tool · MCP transport · JSON-RPC · A2A protocol · A2A client · A2A server · Agent skill · Agent task · Agent artifact · WebMCP · A2A
Questions about tool poisoning
What is tool poisoning?
An attack in which an MCP server hides instructions for the model inside a tool's description, name or schema, so an agent that reads the tool list is steered without the user seeing it: to read files, send data elsewhere or call another tool. It works because agents treat tool descriptions as trusted context.
What does tool poisoning not show or guarantee?
An attack in which an MCP server hides instructions for the model inside a tool's description, name or schema, so an agent that reads the tool list is steered without the user seeing it: to read files, send data elsewhere or call another tool. A scan of the tool list can flag concealed instructions before any tool is called; it cannot prove a tool is safe, only that its published text carries no known pattern.
Which area of the glossary does tool poisoning belong to?
Agents and protocols: How autonomous agents plan, remember, call tools and talk to each other, including MCP and A2A, and where each step can go wrong.
← default scope request · tool lockfile →
See it in the full glossary · 731 terms across 19 areas.