How do you red team MCP agents?
Red teaming MCP agents: the core idea Red teaming MCP agents comes down to one idea: attack your own agent through its tools before someone else does. Most MCP security testing checks OAuth, tokens and transport. That work matters, but it does not show whether your agent will follow a hidden instruction planted in a tool description, a changed tool or a tool's output. Server layer vs model layer…
MCP red teaming aims to attack your own agent through its own tools before others do. While existing testing covers OAuth, tokens and transport, it fails to reveal if the agent follows hidden instructions. MCP security has two layers: server and model. The server layer checks server correctness while the model layer examines the agent's behavior after reading tool descriptions or outputs.
Most teams overlook the model layer. Four MCP attacks to test include tool poisoning, hidden instructions, rug pulls, and tool shadowing. Tool poisoning involves hidden instructions in a tool's description, rug pulls where tools change after approval, and tool shadowing where one MCP server changes how another server's tools are used.
Poisoned tool outputs return incorrect data, a method used by Invariant Labs to hijack the GitHub MCP server and leak data from private repositories. The 7-step MCP red team process involves running tests in staging, mapping servers and tools, recording baselines, planting poisoned descriptions, simulating rug pulls, testing cross-server shadowing, and injecting instructions into tool outputs.
Every tool call should match the user's request and be visible in the log. A single red flag, such as hidden arguments or unexplained tool calls, is a failed test. Re-run the suite whenever descriptions change, new tools appear, or the model is swapped for a different one.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
