Urgent.News

What's breaking now, across thousands of outlets.

More in Tech

MCP Tool Poisoning: A Name Allowlist Is Not Enough

Originally published at webofmike.com on 2026-09-22. The demo repo and every command in it were run before publishing. I built a four-container demo that reproduces an MCP server rewriting its own…

  • Tool name allowlist insufficient to prevent MCP server poisoning
  • MCP server changes tool definitions during runtime, bypassing controls
  • Deny-by-default policy and definition pinning both ineffective against supply-chain threat

More from Tuesday 22 September →