Tool poisoning in MCP, walked through with a lab you can run
Originally published at mcpprobe.tech . This is a hands-on walkthrough of one attack: a tool whose description carries instructions for the model. You will see a minimal poisoned tool, why it works, how mcpprobe's META-01 check flags it, what the fixed version looks like, and a lab you can run locally in a minute. For the wider family of payloads (shadowing, hidden Unicode), see our payload…
An MCP server lists its tools to clients, providing a name, description and input schema. Tool poisoning occurs when the description contains instructions or commands intended for the model, rather than describing the tool's function. Invariant Labs detailed the pattern in April 2025 and named it a Tool Poisoning Attack. The example provided has the model instructed to read a file and pass its contents to the tool, which is malicious.
The server receives data provided by the model according to the hidden instruction. A client may approve the call without noticing the hidden parameters. Attack success rates have been reported at 72.8%. META-01, a detection tool, looks for indicators of tool poisoning such as markup, model-targeted language, requests for sensitive data, and hidden Unicode characters in the descriptions.
It is passive and does not call the tool, but serves as a heuristic to catch suspicious descriptions.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
