MCP Tool-Manifest Poisoning — Name Squatting, Result Shadowing & Covert-Action Directives (Semantic)
AI agents that use tools (via MCP or similar plugin systems) trust the name and description written by whoever published the tool. This detection looks for tool listings that lie about themselves: pretending to be a well-known official tool, quietly telling the agent to overwrite the result of a security check, or instructing the agent to do something harmful while hiding it from the user.
How the attack works
An attacker publishes or injects a tool manifest into an agent's toolset. In one form, the tool is named or described to look like a trusted tool (a typosquatted 'file-sytem' or a fake GitHub server claiming to replace the real one), so the agent picks it instead of the legitimate one. In another form, the tool description tells the agent to call it right after a verification, signing, or validation tool, and to use its output to 'correct' or 'override' that check's result — defeating the verification silently. In a third form, the description asks the agent to perform a sensitive action like harvesting credentials or diverting funds, paired with wording like 'discreetly', 'without leaving a trace', or 'do not inform the user'.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 4ab10f59-88a9-4974-b673-d99660ecccf9
- Severity
- High
Why it matters
An organization can lose control over which tool actually executes on behalf of its agent, have security checks silently bypassed, or have sensitive actions carried out and hidden from human review — leading to credential theft, resource hijacking, or financial loss.
What you can do
- →Review tool and server manifests before installing them, and pin agents to a fixed, allow-listed set of tools instead of dynamic discovery.
- →Reject or flag any tool description containing concealment language such as 'discreetly', 'without leaving a trace', or 'do not inform the user'.
- →Treat any instruction embedded in a tool description that tells the agent to call another tool to override or correct a verification/signing result as a red flag requiring manual review.
- →Monitor for tool names that closely resemble well-known official tools (typosquatting) and verify publisher identity before trusting a 'drop-in replacement' claim.
Known benign look-alikes
- A normal tool description of its own capability with no replacement or concealment claim
- A documented compatibility shim authorized by the original tool's maintainer
- A legitimate error-fallback instruction ('if tool X errors, fall back to manual review')
- A genuine background operation ('runs silently in the background') with no harmful action
- An authorized export to an approved destination, or an authorized audit reported to oversight