MCP Tool Description — IMPORTANT Tag Cross-Tool Shadowing Attack
An MCP (Model Context Protocol) tool can look harmless — like a simple 'add numbers' function — while its description field secretly contains instructions aimed at the AI agent, not the human user. Because the tool-approval UI usually only shows the function signature, a person approving the tool never sees the hidden command.
How the attack works
An attacker publishes or modifies an MCP server so that one of its tools has a normal-looking name and signature, but its description string contains an <IMPORTANT> tag with instructions only the LLM reads. These instructions can direct the agent to read sensitive files (SSH keys, config files like mcp.json) or reference 'the also present' or 'previously declared' tool to chain behavior across other MCP servers installed alongside it. When the agent processes the tool description, it silently follows the embedded instruction instead of just performing the visible function. This was demonstrated publicly in April 2025 against Claude Desktop and Cursor, and again in a fake 'Postmark MCP Server' package that used the same trick to trigger reads of sensitive files.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 6f1b514c-7942-4ed1-815b-540baf777555
- Severity
- Critical
Why it matters
An organization can lose SSH keys, credentials, or configuration secrets to exfiltration without any visible warning, because the malicious instruction rides inside metadata the user never inspects during tool approval.
What you can do
- →Review the full tool description text of any MCP server before approving it, not just the function name and parameters shown in the UI.
- →Treat any tool description containing <IMPORTANT> tags, or references to 'the also present' or 'previously declared' tool, as suspicious and inspect it manually.
- →Pin and audit MCP server packages from a known source; do not auto-update or blindly trust newly published servers with generic names.
- →Restrict agent file-system and network access so that even a poisoned tool description cannot reach SSH keys or config files it references.
Known benign look-alikes
- MCP servers that legitimately use an <IMPORTANT> tag in their README to call attention to prerequisites for the USER (not LLM-visible). These appear in the README body, not in the tool description string served over MCP.
- Security research tools that catalog tool-poisoning attack strings as reference samples — these will match and should be allowlisted by reviewer.
- Test fixtures for MCP scanner tooling (mcp-scan, DefenseClaw, ATR itself) that include example attack payloads for validation — should be in test directories, not served over MCP.
- Legitimate tool descriptions documenting architectural dependencies with user-facing language (e.g. 'this tool is typically used after running the vectorize_docs tool') — these do not use the specific shadowing phrases.