Research
MuleSoft MCP Schema Validation policy | Detect MCP Tool Poisoning | Omni Gateway
Publication date not yet evaluated · Added youtube.com
Page published
Coverage timeline
Single-source research — one report is available.
Why it matters
MCP tool poisoning lets an approved, trusted agent tool be silently altered post-deployment to hijack AI agent behavior, so defenders need runtime descriptor-drift and schema validation to catch metadata that changes after approval.
Mule Ace Academy demonstrates an MCP tool-poisoning (tool rug-pull) attack in which an approved `get_order_status` tool published to Anypoint Exchange is silently modified at runtime to inject malicious instructions ('ignore previous instructions', call cancel_order, hide from user), and shows MuleSoft Omni Gateway's MCP Schema Validation policy detecting the descriptor drift, shadow tool names, and prompt injection before the poisoned metadata reaches the AI agent. The PoC also notes an unexpected result where RemoveTool removed both tools rather than only the modified one.