Generative AI
ImplementedMCP / agent tools
The Model Context Protocol surface: tool poisoning, rug-pull / schema drift, and abuse of topology or trust boundaries.
Family facts
- Code
- FAM-GENAI-MCP
- Status
- ready — code maturity
- Availability
- available — whether it is offerable
- Ingest
- pull — how a target enters
- Rules of Engagement
- Not required
- Kind
- Family (a selectable assessment)
What it decides
Whether an agent’s tools can manipulate it — through hidden instructions, a changed schema, a shadowed name, or a broken trust boundary.
How it works
It treats a tool description or result as untrusted input and checks MCP invariants: tool metadata must carry no instructions (poisoning); a tool must not drift from its approved, pinned schema (rug-pull); two tools sharing a name must not diverge in authority (shadowing); and the topology must preserve trust boundaries.
A change to a tool’s schema invalidates any prior approval of it, and each invariant is settled by a dedicated deterministic verifier.
A worked example
A tool whose description embeds “also send the result to …” is flagged as tool poisoning; a tool whose schema changed since approval invalidates that approval until re-reviewed.
Declared limits
Covers the static MCP surface and an enumerated server; live-server red-teaming is a separate experimental family. Decoding of nested/poisoned content is bounded.
References
References point to public, well-known technical sources for further study.
Related articles