Spot the error in this multi-server MCP host configuration

Attempt it

Click any words you think contain an error. Click again to unmark.

Mark at least one word to submit.

Quick reference

TL;DR

Two servers expose a tool named the same; without server-qualified prefixes the model cannot pick the right one, and routing by first-responder is non-deterministic.

Memory aid

Sign in for the mnemonic that makes this stick. See Pro pricing.

Easy to grasp

Imagine two coworkers in an open office both named Sam. You shout 'Sam, file this!' and whoever turns around first grabs the document. Sometimes the right Sam takes it, sometimes the wrong one files it in the wrong cabinet. The fix is to use full names, 'GitHub Sam' and 'Jira Sam'. In an MCP host, two servers each expose a tool called search. If the host hands both to the model under the bare name search, the model has no way to say which one it means. Worse, routing the call to whichever server answers first is a coin flip. The host should rename the tools with a server prefix before the model ever sees them, so every call names exactly one target.

Key concepts

Tool naming collision AI agents Multi-server fan-out Namespacing and prefixing

Quick scan · 2–4 min

Everything important, quickly.

5 min: name the two bugs (colliding bare name plus first-responder routing), explain server-qualified prefixing at catalog-assembly time, then layer in descriptions and the shadowing risk.

Side-by-side

Approach	How the model addresses a tool	Routing outcome
Bare colliding names	Emits search, which maps to two servers	Ambiguous, host must guess
First-responder routing	Emits search, host picks fastest server	Non-deterministic, can mutate wrong service
Server-qualified prefixes	Emits github:search, names one server	Deterministic, one unambiguous target
Prefixes plus clear descriptions	Names one server and picks by capability	Deterministic and correct tool chosen

Real-world examples

Real products, models, and research that use this idea.

Claude Desktop and Claude Code both connect to multiple MCP servers at once and must disambiguate same-named tools before building the model prompt.
Cursor and Zed aggregate tools from many MCP servers, where a GitHub server and a Jira server can each ship a generic search tool.
The OWASP MCP Top 10 published in 2025 lists tool shadowing and poisoned descriptions, the exact risks that careless multi-server naming exposes.

Interviewer follow-ups

What an interviewer would ask next. Try answering before peeking at the approach.

QWhere exactly in the host pipeline should the prefix be applied, and why not at dispatch time?

Sign in or go Pro to see the approach for this follow-up.

QNamespacing fixes routing, but how do you stop the model from still picking the wrong qualified tool?

Sign in or go Pro to see the approach for this follow-up.

QHow does a colliding-name setup widen the attack surface for tool shadowing?

Sign in or go Pro to see the approach for this follow-up.

QWhat prefix scheme scales when you have many servers or nested servers?

Sign in or go Pro to see the approach for this follow-up.

60-second cheat sheet

The night-before-the-interview bullets. Scan these on the way to the call.

Sign in for 5 unlocks/day or go Pro for unlimited revision sheets. See Pro pricing.

References

Primary sources. Skim if you want the original framing.