MCP Tool Poisoning: A Name Allowlist Is Not Enough
Originally published at webofmike.com on 2026-09-22. The demo repo and every command in it were run before publishing. I built a four-container demo that reproduces an MCP server rewriting its own tool definitions mid-session, and puts two controls in front of it to see which one actually catches it. The code is at themsquared/mcp-tool-rbac . The finding is the part I did not expect to be so…
In a recent discovery, researchers found that a tool name allowlist is insufficient to prevent malicious actions in a multi-container demonstration. The demo implements an MCP server that changes its own tool definitions during runtime and presents two controls to assess which one effectively catches the malicious behavior. The investigators utilized a four-container environment to run the code from the repository themsquared/mcp-tool-rbac.
The researchers aimed to test whether a deny-by-default policy on the tool names would be sufficient to stop the MCP server from rewriting its tool definitions mid-session. Despite the deny-by-default rule on the tool names, the model was still exposed to a credential-hunting instruction. The researchers concluded that the allowlist was not addressing the problem they intended it to tackle.
In August, Pillar Security disclosed an active MCP supply-chain campaign named Deadbugz. A single account submitted 23 pull requests across unrelated AI and developer-tool projects in just 74 minutes. Each pull request set up the project to connect to a remote MCP server called productivity-suite, which provided two tools: text formatting and summarization.
The server behaved normally at first, but after three tool calls, it began returning instructions to locate SSH keys, AWS credentials, shell history, and kubeconfig, while concealing these activities from the operator.
Key to understanding this issue is the fact that an MCP tool is not an API endpoint called by name. Instead, the tool description is part of the model's context, and the model reasons over it. Therefore, a changed tool description is essentially a modified program delivered to the agent at runtime, with the name being irrelevant. This failure demonstrated in the report is an example of a rule existing within the same channel as the attacker, which does not constitute a valid control.
The researchers conducted three scenarios, each involving the same poisoned server with variations in controls. Scenario 1 involved no broker and exhibited the expected poisoning behavior of the MCP server. Scenario 2 utilized a deny-by-default rule on the tool names, allowing the malicious tool descriptions to pass through and execute the desired actions. Scenario 3 combined deny-by-default with definition pinning, which prevented the server from accepting any changes to its tool definitions.
In conclusion, the findings emphasize the need for a more comprehensive and robust control mechanism to defend against such malicious activities in MCP environments. The demonstration underscores the importance of continuously improving the security framework for software-defined tools to ensure they are more resilient against supply-chain threats and runtime manipulation.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
