Research · curated 12 Sep 2026

MuleSoft MCP Schema Validation policy | Detect MCP Tool Poisoning | Omni Gateway

First reported today youtube.com

Coverage timeline

Single-source research — first reported, latest, and curated coincide.

Why it matters

MCP tool poisoning lets an approved, trusted agent tool be silently altered post-deployment to hijack AI agent behavior, so defenders need runtime descriptor-drift and schema validation to catch metadata that changes after approval.

Mule Ace Academy demonstrates an MCP tool-poisoning (tool rug-pull) attack in which an approved `get_order_status` tool published to Anypoint Exchange is silently modified at runtime to inject malicious instructions ('ignore previous instructions', call cancel_order, hide from user), and shows MuleSoft Omni Gateway's MCP Schema Validation policy detecting the descriptor drift, shadow tool names, and prompt injection before the poisoned metadata reaches the AI agent. The PoC also notes an unexpected result where RemoveTool removed both tools rather than only the modified one.