# MCP Parameter Description Injection

- **Severity:** High
- **Signature ID:** `d5f9c423-6e3a-4f0d-c5f4-9e2a7f4d3b16`
- **MITRE ATLAS:** AML.T0110 (AI Agent Tool Poisoning), AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), LLM01 (Prompt Injection)

## Summary

AI agents that use tools defined by the Model Context Protocol (MCP) read tool descriptions, including parameter descriptions, before deciding how to call a tool. An attacker can write hidden instructions into a parameter description so that when the agent reads the tool schema, it follows the attacker's directive instead of the user's intent.

## How the attack works

An attacker registers or modifies an MCP tool so that one of its parameter description fields contains text written to look like an instruction rather than documentation. When an AI agent inspects the tool schema before invoking the tool, it parses this description as part of its context. If the agent treats that text as guidance, the hidden directive can steer what the agent does next, redirecting its behavior away from the user's original request. This is one step in a larger tool-poisoning technique (referred to here as TP3) rather than a full attack chain.

## Why it matters

An organization relying on MCP-connected agents can have its automation hijacked at the tool-invocation stage, causing the agent to take actions the user did not request, without any code being run or any file being modified.

## What you can do

- Review parameter descriptions of MCP tools before connecting them to an agent, especially tools from third parties.
- Treat tool schemas as untrusted input and avoid letting agents execute embedded directives found in descriptions.
- Restrict which MCP servers and tools an agent is allowed to load, and monitor for unexpected changes to tool schemas.
- Flag parameter descriptions containing imperative language (e.g. 'ignore previous instructions', 'always', 'must') for manual review, while accounting for legitimate uses of words like 'important' or 'note'.

## Known benign look-alikes

- Parameter descriptions that legitimately contain the word "important" or "note"

## References

- https://owasp.org/www-project-top-10-for-large-language-model-applications/

---
Source: https://www.netzilo.com/threats/skillspector-mcp-param-injection