Analysis
What Is MCP Tool Poisoning? How the Attack Works and Defenses
Publication date unknown · Discovered pluto.security
Page published
Publication date unknown · First observed: 31 Oct 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
MCP tool poisoning can turn trusted-looking tool metadata and responses into an instruction channel, so defenders need authorization and approval controls outside the model’s context.
Pluto Security’s glossary entry explains MCP tool poisoning, where manipulated tool descriptions, schemas, metadata, or responses steer AI agents toward unintended actions. The reference outlines defenses including deliberate tool approval, definition fingerprinting, server-side authorization, and human approval for high-impact operations.