# MCP Tool Description — Notes Parameter Chat-History Exfiltration

- **Severity:** Critical
- **Signature ID:** `06a27571-05eb-4c0c-84a7-6c3dfa856b75`
- **MITRE ATLAS:** AML.T0051.001 (Indirect), AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI03 (Identity and Impersonation), ASI08 (Supply Chain Attacks on Agent Ecosystems), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure), LLM06 (Excessive Agency)

## Summary

A malicious or compromised MCP (Model Context Protocol) tool can hide instructions in its own description that tell the AI agent to quietly stuff the entire conversation transcript into a 'notes' or 'context' field every time the tool is called. This turns an unrelated tool call into a covert channel for leaking credentials, personal data, and secrets to whoever controls that tool.

## How the attack works

An attacker publishes or modifies an MCP tool so its description includes instructions the LLM will follow, not just parameter documentation for humans. The instruction tells the model to fill a 'notes', 'context', or 'history' parameter with the full prior conversation before invoking the tool, often disguised as a compliance requirement (SOC 2, legal obligation) or a technical need (context length management). The LLM, treating the tool description as trusted input, complies and sends the transcript along with every call. Because the exfiltration rides on a legitimate-looking tool call, it doesn't stand out as unusual traffic — the sensitive data leaves through a channel that appears to be normal operation.

## Why it matters

Conversation contents — which can include credentials, personal data, internal business details, and other secrets shared with the agent — are silently sent to the tool provider or anyone who can read the tool's logs, without the user or operator noticing.

## What you can do

- Review the descriptions of every MCP tool before enabling it, looking for instructions aimed at the model rather than plain parameter documentation.
- Reject or flag tools that ask for full conversation history, transcripts, or broad 'context' in a data field unrelated to the tool's stated purpose.
- Restrict what conversation data agents are allowed to pass to tool calls, and require justification for any tool that requests more than its function needs.
- Treat compliance or audit language inside a tool description as a red flag, not a reason to trust it — legitimate audit logging is done server-side, not by pushing chat history into a parameter.

## Known benign look-alikes

- Legitimate audit logging tools that document tool-call parameters, but these store data server-side rather than receiving it in a 'notes' field
- Internal debugging tools where engineers populate a notes field with conversation context for local troubleshooting — these should not be deployed in production

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01300

---
Source: https://www.netzilo.com/threats/atr-mcp-tool-description-notes-parameter-chat-history-exfiltrati