What is Tool poisoning?

There is no formal standard that defines tool poisoning. The best primary description is the OWASP MCP Top 10, an OWASP project that was still in an early draft version when fetched, so the wording may change. The cited page is that project's entry for the risk, MCP03.

OWASP describes the core problem as schema poisoning. An attacker tampers with the definitions that tell an agent how to call a tool, so a harmless-looking operation turns destructive and an agent that trusts the schema carries it out. The page also treats malicious text in a tool's name, description, or parameter descriptions as a warning sign. Examples it lists include instructions aimed at the model, references to sensitive file paths, and hidden zero-width or bidirectional characters.

The attack routes it names include a compromised build pipeline, a tampered dependency that ships altered tool manifests, an insider with registry write access, and rewriting of schemas in transit.

The mitigations it lists are signing schemas and verifying hashes, keeping schemas in a version-controlled registry with reviewed changes, separating who may propose, approve, and publish changes, logging which schema hash each call used, and requiring human approval for high-impact operations.