How does a host handle tool name collisions when connected to multiple MCP servers?

Attempt it

When a host connects to three MCP servers simultaneously and two of them expose a tool called `search`, how does the host typically handle the collision? Is this enforced by the protocol?

Free · 2 AI evals / day

Quick reference

TL;DR

MCP only guarantees unique tool names within one server, so the host must namespace tools across servers, usually by prefixing names with the server id.

Memory aid

Sign in for the mnemonic that makes this stick. See Pro pricing.

Easy to grasp

Imagine two coworkers both named Alex. Inside their own teams, there is only one Alex, so first names work fine. But the moment they join one big meeting, saying 'Alex' is ambiguous, and the chair has to say 'Alex from Sales' or 'Alex from Support'. MCP is the same. Each server promises its own tool names are unique, but it knows nothing about the other servers in the room. The host is the meeting chair. When it pulls tools from several servers at once, it relabels them with the server name, like `github:search` and `web:search`, before handing the list to the model. The protocol never forces this, so it is the host's judgment call.

Key concepts

Tool namespacing Multi-server fan-out Tool shadowing MCP security

Quick scan · 2–4 min

Everything important, quickly.

4 min: spec guarantees uniqueness only per server, host fans out and namespaces by prefix, shadowing failure mode, then the security boundary and allowlist defenses.

Side-by-side

Concern	Within one server	Across multiple servers
Name uniqueness	Guaranteed by spec	Not guaranteed, host's problem
Who disambiguates	Server author	The host application
Typical mechanism	Plain tool names	Server-prefixed names plus allowlists
Failure if ignored	Schema validation error	Silent shadowing or security bypass

Real-world examples

Real products, models, and research that use this idea.

Claude Desktop and Claude Code aggregate tools from every server in their config and namespace them so two servers exposing `search` stay distinct.
Cursor lets users enable or disable individual MCP servers, which sidesteps collisions by trimming the active tool set the model sees.
The OWASP MCP Top 10 lists cross-server tool shadowing as a named risk, where a malicious server overrides a legitimate server's tool.

Interviewer follow-ups

What an interviewer would ask next. Try answering before peeking at the approach.

QHow would you design a host's tool-routing layer so a malicious server cannot shadow a trusted server's tool?

Sign in or go Pro to see the approach for this follow-up.

QPrefixing inflates the model's tool list and token cost. How do you keep disambiguation cheap at scale?

Sign in or go Pro to see the approach for this follow-up.

QIf two servers expose identically named tools with subtly different schemas, how does the model pick correctly?

Sign in or go Pro to see the approach for this follow-up.

60-second cheat sheet

The night-before-the-interview bullets. Scan these on the way to the call.

Sign in for 5 unlocks/day or go Pro for unlimited revision sheets. See Pro pricing.

References

Primary sources. Skim if you want the original framing.