MCP Tool Poisoning: Enterprise Controls for AI Agent Integrations

Model Context Protocol tools can connect agents to valuable data and actions. That power also makes tool metadata, server provenance, authorization, local execution, and dynamic capability changes part of the security boundary.

Why tool metadata matters

Agents use names, descriptions, and schemas to decide when and how to call a tool. A malicious or changed definition can steer behavior even when the visible user request looks harmless. Treat server upgrades and tools-list changes as security-relevant configuration changes.

Control provenance and execution

• Pin approved packages, versions, hashes, or signed artifacts.
• Prefer isolated execution with the minimum filesystem and network access.
• Review the exact startup command for local servers.
• Block unapproved dynamic tool additions.
• Separate development, testing, and production credentials.

Control identity and authorization

NIST’s agent identity concept paper highlights identification, authentication, authorization, audit, non-repudiation, delegation, and binding agent actions to human authority. Give each agent and integration a distinct identity, validate token audience, and scope every token to the intended resource.

Design for detection and rollback

Record server identity, tool definition version, caller, user, scopes, arguments, result, and approval. Alert on new servers, expanded scopes, unusual call volume, sensitive data access, and failed authorization. Maintain a fast disable path for a server or tool without disabling unrelated workflows.

Next step for your environment

Create an MCP register that maps every server and tool to an owner, version, data class, permission set, approval rule, and kill switch. If you need a documented baseline before changing production systems, start with an ITECS technology and security assessment.

Record the current baseline, accountable owner, source date, acceptance evidence, exceptions, and review trigger. Recheck assumptions before every consequential change, preserve rollback instructions, and close the work only when the intended result and unintended effects have been verified in the real environment. Keep the decision record with the system documentation so the next review starts from evidence rather than memory.

Sources and update trigger

• Model Context Protocol — Security best practices
• NIST — Software and AI agent identity concept paper
• NIST — AI Risk Management Framework

Review trigger: Review on each MCP specification/security revision or material client/server upgrade.