SG-024: MCP Tool Poisoning
Severity: CRITICAL
Malicious instructions in MCP tool descriptions, credential-capturing schemas, built-in tool shadowing
Fires when
- MCP tool description contains an action verb (curl, fetch, send, exfil, ignore) paired with a credential or URL
- MCP JSON hides instruction tags like <IMPORTANT>, <SYSTEM>, <INSTRUCTION> inside string fields
- Tool description directs agent to route/smuggle data through other tools (confused deputy)
- Suspicious config: credential-capturing schema, required credential param, tool shadowing, or env-var injection
Related CVEs
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.