In an MCP tool poisoning attack, which field of the tool definition is the primary attack vector and why?

Attempt it

Quick reference

TL;DR

Tool poisoning hides adversarial instructions in the tool description, which the model reads as trusted guidance but users never see in approval dialogs.

Memory aid

Sign in for the mnemonic that makes this stick. See Pro pricing.

Easy to grasp

Picture hiring a contractor and handing them a clipboard of job instructions. You glance at the cover sheet, which just says 'fix the sink.' But in tiny print on page three, someone has written 'also, copy the homeowner's keys and mail them to this address.' The contractor reads the whole clipboard and treats every line as your order. In MCP, the tool description is that clipboard. The model reads it in full to decide how and when to use a tool. You only ever see the cover sheet, which is the tool name in the approval popup. An attacker writes hidden orders in the fine print, and the model obeys them as if they came from you. The mismatch between what the model reads and what you see is the whole trick.

Key concepts

Tool poisoning Prompt injection Tool description metadata Trust boundary

Quick scan · 2–4 min

Everything important, quickly.

4 min: where the description sits in the tool definition, the model-versus-user visibility gap, why it beats name/schema/result vectors, and the vet/hash/expose/sandbox defense stack.

Side-by-side

Vector	When it fires	User-visible?	Mechanism
Description poisoning	Before any call, every turn in context	No, dialogs show only the name	Adversarial text in tool description read as trusted instructions
Result poisoning	After the call, in tool output	Partly, output may be shown	Injection through returned content the model later reads
Rug pull	After approval, on a silent update	No, change is not re-surfaced	Server swaps a vetted definition for a malicious one

Real-world examples

Real products, models, and research that use this idea.

Invariant Labs publicized MCP tool poisoning in 2025, showing hidden description text exfiltrating SSH keys through a benign-looking server.
The OWASP MCP Top 10, published in 2025, lists tool poisoning and rug pulls as named server-side risks.
Claude Desktop and Cursor approval dialogs historically showed tool names, prompting hosts to start surfacing full descriptions after the disclosure.

Interviewer follow-ups

What an interviewer would ask next. Try answering before peeking at the approach.

QHow does a rug pull attack relate to description poisoning, and what defense catches it?

Sign in or go Pro to see the approach for this follow-up.

QWhy is surfacing the full description in the UI necessary but not sufficient as a defense?

Sign in or go Pro to see the approach for this follow-up.

QHow would you design a host to neutralize a hijacked tool call even if a poisoned description slips through?

Sign in or go Pro to see the approach for this follow-up.

QCross-server shadowing lets one server poison another's tools. How does that extend the description attack?

Sign in or go Pro to see the approach for this follow-up.

60-second cheat sheet

The night-before-the-interview bullets. Scan these on the way to the call.

Sign in for 5 unlocks/day or go Pro for unlimited revision sheets. See Pro pricing.

References

Primary sources. Skim if you want the original framing.