# Suspicious MCP Tool Descriptions

- **Severity:** High
- **Signature ID:** `27eee8c9-af55-5190-8601-1e7b365afc99`
- **MITRE ATLAS:** AML.T0110 (AI Agent Tool Poisoning), AML.T0068 (LLM Prompt Obfuscation)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), LLM01 (Prompt Injection)

## Summary

AI agents that use the Model Context Protocol (MCP) read tool descriptions as trusted setup text before ever calling the tool. An attacker can plant commands inside that description text to steer the agent's behavior without executing any visibly malicious action.

## How the attack works

An attacker registers or modifies an MCP tool or gateway so its description field contains injected instructions, often phrased with forceful language like ALWAYS or MUST, or using formatting tricks such as embedded control sequences. When the agent loads the tool, it reads the description as part of its trusted context, before any tool call is made. The injected text can redirect the agent's later actions, exfiltrate data, or bypass intended constraints. Because the manipulation lives in the description rather than in a tool call or its output, it does not show up as an obviously malicious action in the transcript.

## Why it matters

An agent can be silently redirected to take unintended actions or leak information, with the manipulation hidden in setup text rather than in an auditable tool call, making it harder to spot during a review of agent behavior.

## What you can do

- Review tool and gateway descriptions before allowing an agent to load them, especially from third-party or user-supplied MCP servers.
- Treat imperative language (ALWAYS, MUST, NEVER) in tool descriptions as a review flag, not an instruction to trust automatically.
- Strip or sanitize control characters and unusual formatting from tool descriptions before they reach the model.
- Log and monitor tool registration and description content separately from tool-call activity, since malicious intent may never appear in the calls themselves.

## Known benign look-alikes

- API documentation that genuinely uses ALWAYS and MUST in the same description
- Terminal-oriented tools whose descriptions embed colour codes for output samples
- Security tools whose descriptions quote injection markers as examples

## References

- https://attack.mitre.org/techniques/T1546/
- https://attack.mitre.org/techniques/T1027/
- https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks

---
Source: https://www.netzilo.com/threats/mcp-tool-poisoning