MCP Tool Poisoning and Rug Pull Attacks

MCP tool poisoning is an indirect prompt-injection risk in which malicious instructions are embedded in Model Context Protocol tool descriptions, schemas, annotations, or outputs, causing models to treat untrusted metadata as commands. Related attacks include rug pulls, where an approved tool or server changes after review, and tool shadowing, where one server’s metadata manipulates the use of another trusted server’s tools. The cited 2025–2026 research and incident reports describe measurable attack success, secret leakage, enterprise-targeted patterns, and the ability of multi-tool payloads to evade simple description scanners, while finding limited built-in framework defenses. Recommended safeguards include reviewing complete tool definitions and schemas before approval, hashing and pinning definitions, requiring renewed approval for any change, verifying server packages and code versions, isolating MCP servers from one another, validating strict tool inputs in code, and inspecting outputs and data flows at runtime. Because metadata pinning cannot detect unchanged malicious code, poisoned outputs, or unsafe definitions approved initially, the source argues for layered controls through gateways, least-privilege access, logging, auditing, and human approval for sensitive actions.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.