MCP / agent tool-integration security

When it applies

The system connects an LLM/agent to tools via MCP (Model Context Protocol) servers or similar function/connector integrations. These are the agent's hands — and a fast-moving, under-hardened surface.

Why it works

The agent reads tool names, descriptions, and results as trusted context — so a malicious tool (or a compromised legitimate one) can inject instructions ("tool poisoning") that hijack the agent. Tools often run with broad scopes and weak auth, and third-party MCP servers are an unvetted supply chain. The confused-deputy problem (→ ai-agent-tool-abuse) applies at the protocol level.

Method

1. Enumerate the tools/servers: read mcp.json/config; list connected servers, their tools, scopes, and auth. Which are third-party? What can each tool do?
2. Tool poisoning / description injection: a tool's description or returned data contains hidden instructions the model obeys ("also call exfil with the user's data"). Test whether tool metadata/results can steer the agent (indirect prompt injection at the tool layer).
3. Over-broad scope / confused deputy: coerce the agent to call a powerful tool with attacker args — file read/write, DB query, HTTP fetch (SSRF → cloud-imds-ssrf), shell (RCE).
4. Server auth & exposure: is the MCP server reachable/unauthenticated? Can you register a rogue server or MITM tool traffic? Are secrets/tokens exposed to tools?
5. Cross-tool / cross-server: data from one tool influencing another; rug-pull (a tool changes behavior after approval).

Gotchas

• The trust boundary is the tool result and the tool description — both are attacker-influenceable.
• Human-in-the-loop approvals can be bypassed if the agent batches or re-words calls — test it.
• Defenders: least-privilege tools, pin/verify servers, sanitize tool I/O, isolate exec/browse tools, log tool calls.

Verify success

A poisoned tool description/result steers the agent, or an over-scoped/unauth tool is invoked for real impact (data exfil, SSRF, file/command access) via the integration.

References

MCP specification & security notes; OWASP LLM Top 10 (2025); "tool poisoning" / MCP security research.