Hidden instructions inside an MCP tool description

CriticalAV-MCP-105MCPMCP config packNew in 2.0

What it finds

An MCP tool description contains instructions aimed at the AI — like "ignore previous instructions", "do not tell the user", or a request to read SSH keys or config files.

Why it matters

Tool descriptions are read by the model but rarely by people. This is "tool poisoning": a malicious server can quietly tell the AI to leak files or misuse other tools the moment it is connected.

What an attacker could do: Connecting this server could make the AI read private files or send data to the attacker without the user noticing.

How to fix it

Do not connect this server. If it is yours, rewrite the description so it only says what the tool does, in plain words, and review every description before publishing.

Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans

Check details

Finding code: MCP_TOOL_POISONING
How it detects: Looks for a specific risky pattern in the code or config.
Confidence: Likely: strong signal, but review it in context.
Scans: MCP client configuration files: claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json, .mcp.json
OWASP LLM Top 10: LLM01 - Prompt Injection, LLM05 - Supply Chain Vulnerabilities
NIST AI RMF: MS-2.3, GV-6.1
SOC 2: CC7.1, CC9.2

Check your agent for this

Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.

Scan an agent free Run it in CI or your editor