{
  "id": 9163499,
  "title": "MCP Tool Poisoning: A Name Allowlist Is Not Enough",
  "url": "https://urgent.news/2026/09/22/mcp-tool-poisoning-a-name-allowlist-is-not-enough",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-22T16:56:49.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/webofmike/mcp-tool-poisoning-a-name-allowlist-is-not-enough-5le"
  },
  "original_language": "en",
  "account": "In a recent discovery, researchers found that a tool name allowlist is insufficient to prevent malicious actions in a multi-container demonstration. The demo implements an MCP server that changes its own tool definitions during runtime and presents two controls to assess which one effectively catches the malicious behavior. The investigators utilized a four-container environment to run the code from the repository themsquared/mcp-tool-rbac.\n\nThe researchers aimed to test whether a deny-by-default policy on the tool names would be sufficient to stop the MCP server from rewriting its tool definitions mid-session. Despite the deny-by-default rule on the tool names, the model was still exposed to a credential-hunting instruction. The researchers concluded that the allowlist was not addressing the problem they intended it to tackle.\n\nIn August, Pillar Security disclosed an active MCP supply-chain campaign named Deadbugz. A single account submitted 23 pull requests across unrelated AI and developer-tool projects in just 74 minutes. Each pull request set up the project to connect to a remote MCP server called productivity-suite, which provided two tools: text formatting and summarization. The server behaved normally at first, but after three tool calls, it began returning instructions to locate SSH keys, AWS credentials, shell history, and kubeconfig, while concealing these activities from the operator.\n\nKey to understanding this issue is the fact that an MCP tool is not an API endpoint called by name. Instead, the tool description is part of the model's context, and the model reasons over it. Therefore, a changed tool description is essentially a modified program delivered to the agent at runtime, with the name being irrelevant. This failure demonstrated in the report is an example of a rule existing within the same channel as the attacker, which does not constitute a valid control.\n\nThe researchers conducted three scenarios, each involving the same poisoned server with variations in controls. Scenario 1 involved no broker and exhibited the expected poisoning behavior of the MCP server. Scenario 2 utilized a deny-by-default rule on the tool names, allowing the malicious tool descriptions to pass through and execute the desired actions. Scenario 3 combined deny-by-default with definition pinning, which prevented the server from accepting any changes to its tool definitions.\n\nIn conclusion, the findings emphasize the need for a more comprehensive and robust control mechanism to defend against such malicious activities in MCP environments. The demonstration underscores the importance of continuously improving the security framework for software-defined tools to ensure they are more resilient against supply-chain threats and runtime manipulation.",
  "summary": "Originally published at webofmike.com on 2026-09-22. The demo repo and every command in it were run before publishing. I built a four-container demo that reproduces an MCP server rewriting its own tool definitions mid-session, and puts two controls in front of it to see which one actually catches it. The code is at themsquared/mcp-tool-rbac . The finding is the part I did not expect to be so…",
  "key_points": [
    "Tool name allowlist insufficient to prevent MCP server poisoning",
    "MCP server changes tool definitions during runtime, bypassing controls",
    "Deny-by-default policy and definition pinning both ineffective against supply-chain threat"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}