MCP tool poisoning: hidden instructions in tool descriptions

What it is

Invariant Labs published this as a “Tool Poisoning Attack” against the Model Context Protocol on 1 April 2025. Tool descriptions are passed to the model as trusted context, so text in them acts like instructions.

Their write-up shows a harmless-looking tool whose description tells the agent to read sensitive local files and pass them along as a hidden parameter.

How to check

1. List every MCP server configured in your editor or agent, and where each one came from.
2. Read the full tool descriptions each server exposes, not the short name your client shows.

How to fix

1. Only install MCP servers from sources you trust, and pin versions.
2. Keep human approval on for tool calls that read files or reach the network.

Sources

• Invariant Labs: MCP Security Notification: Tool Poisoning Attacks ↗