What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
MCP tool poisoning is an indirect prompt-injection attack in which instructions are hidden in a tool’s metadata—such as its description or parameter schema—to influence an AI agent that reads it. Treat those descriptions as untrusted input: inspect them before exposing tools to an agent, and constrain what the agent can do at runtime. These controls reduce exposure; none is established as a complete prevention method.
How tool poisoning works
An MCP client can provide an agent with a tool’s name, description, and schema so the agent can decide whether and how to call it. A poisoned tool description can include instructions aimed at the model rather than a human reader. OWASP defines MCP Tool Poisoning as an indirect prompt-injection attack against agents connected to external tool servers through MCP; Microsoft likewise describes malicious instructions embedded in tool descriptions. OWASP’s MCP guidance also identifies schemas and tool return values as relevant inputs. OWASP MCP Tool Poisoning, Microsoft’s explanation of indirect prompt injection in MCP, and the OWASP MCP Security Cheat Sheet discuss these risks.
This differs from an ordinary user instruction: the instruction arrives through tool metadata supplied by an external server, not as a direct request from the user. Research on MCP clients notes that many use textual names and descriptions without cryptographic verification or contextual awareness; clients do not all handle metadata identically. A description may attempt to promote its tool over alternatives or steer the agent toward an action, but whether it works depends on the model, client, permissions, and environment. The 2026 ACM survey record discusses this class of preference manipulation.
What a poisoned tool might try to do
Malicious metadata may try to persuade an agent to select a particular tool, follow concealed directions, request sensitive context, or pass data through a tool action. These are potential outcomes, not guaranteed results. The actual risk depends on what the agent can access, what the tool implementation does, and whether the client or surrounding system enforces limits.
#1 Best Overall
- Valued Carpenter Pencil Set: You will get 2 pcs solid carpenter pencils with 26 piece 2.8 mm refills, 1 replaceable sharpener, 1 plastic storage box.The complete carpenter pencils combination allows you to finish your work faster and more easily
- Deep Hole Marker Pencil: The deep-hole construction pencils adopts 45mm elongated tip design, which is more convenient to mark in the small hole or in other tight areas that other carpenter markers cannot reach
- Carpenter Pencils with Sharpener: The sharpener is screwed into the top of the work pencil, which won't get lost either. Built-in pencil sharpener that keep the lead with pointed and smooth to Improves line of sight in fine work
- Stronger Solid Lead: This work pencil is matched with a 2.8 mm thick lead , which is much thicker and stronger during the drawing process of construction work, it will not break or damage easily
- Marks on Various Surfaces: 3 colors solid construction pencil can marks on various surfaces,such as metal, plastic, wood, paper etc. Ideals for woodworkers, contractors, craftsmen, builders, merchants and masons
Tool poisoning should also be distinguished from related MCP risks. Tool shadowing and server-side request forgery (SSRF) appear in OWASP’s broader MCP security guidance, but they are not synonyms for poisoning. Similarly, instructions placed in returned external content are an indirect prompt-injection path through tool results; poisoning places the attack in tool metadata. OWASP’s MCP security guidance covers these adjacent concerns.
How to reduce exposure
Review metadata before offering tools
Inspect descriptions and schemas before connecting a server to an agent. Look for instructions that appear unrelated to the tool’s function, attempts to override other rules, requests for sensitive context, or language that pressures the model to select that tool. Microsoft’s 2026 control-plane guidance describes scanning tool descriptions for hidden instructions, typosquatting, and adversarial patterns before exposing them to an agent. Automated scanning can help flag suspicious text, but it should not replace review or authorization controls. Microsoft’s control-plane article describes this pre-use layer.
Rank #2
- Ergonomically Designed: Work in tight areas with a compact design that gets into tough spots
- Compact and Lightweight: Both tools are designed to fit into difficult to reach spaces. The 1/4" impact driver has a length of 5.55 in. and weighs just 2.8 lbs, while the 1/2" drill/driver measures only 7.5 in. and weighs 3.6 lbs
- Both the DEWALT impact driver and electric drill driver feature integrated LED work lights with a convenient 20-second delay, ensuring enhanced visibility in dimly lit or challenging work areas
- One-Handed Loading - Keep one hand free with a 1/4 in. hex chuck that accepts 1 in. bit tips
- Power drill cordless with 1/2" single sleeve ratcheting chuck provides tight bit gripping strength, making bit changes faster and more secure
Keep descriptions narrow and unambiguous
Write tool descriptions that explain only what the tool does and when it should be called. Anthropic’s MCP Directory Policy states: “MCP tool descriptions must narrowly and unambiguously describe what the tool does and when they should be invoked.” That is a directory policy, not proof that clear descriptions alone prevent poisoning. Anthropic MCP Directory Policy.
Constrain permissions and validate calls at runtime
Do not let an agent’s tool access exceed what its task requires. Validate proposed calls and inspect tool responses rather than assuming that an approved server will always behave safely. The ShieldMCP paper describes a runtime framework that validates tool calls and responses. In its own red-team evaluation across five LLM backends, the paper reports attack success rates falling from 74% to under 9% for tool poisoning and from 47% to under 6% for indirect prompt injection through tool responses, with median added latency below 120 ms per tool call. These are results from that evaluation, not general production guarantees. Association for Computational Linguistics Anthology, “Securing the Tool Layer” (2026).
Rank #3
- 【Great Compatibility】This Katerk 1/4 inch hex shank bit holder is specifically designed for 1/4 inch hex shank drill bits. It's compatible with most 1/4 fast hex handles, hex sockets, various electric screwdrivers, and handheld screwdrivers. The bit holder makes it a valuable addition for any handyman.
- 【Secure and Safe】Built with a secure backup nut design, each drill bit holder securely locks onto your bits, ensuring they stay firmly in place. Additionally, our bit holder incorporates a high-quality steel ball rolling design that holds up to several kilograms of weight, ensuring your various drill bits don't fall off.
- 【Easy One-Handed Operation】The bit holder for impact driver allows you to change bits single-handedly, simplifying your workflow. Its multi-color design further allows for quick identification of the drill bit you need.
- 【Compact and Convenient】Thanks to its compact size, this 1/4 inch bit holder is easy to carry around. The bit holder allows for easy attachment to various tools, making this a convenient addition to your construction accessories. The Katerk bit holder is cast from high-quality alloy material, promising a long product lifespan. Despite its rugged strength, the bit holder remains lightweight, making it portable.
- 【Cool Christmas Gift For Men Stocking Stuffers】 This screwdriver bit holder, driver bit holder, impact bit holder, can be given as a gift to your loved one, especially for anyone involved in construction or electrical work. It's a must-have for stocking stuffers for men and women, tools gifts for dad, tech gadgets for men, gifts for dad, gifts for him, gifts for husband, gifts for boyfriend, cool gadgets for men, and cool gifts for dad.
Where each defense acts
| Layer | What it addresses | When it acts | Trust assumption |
|---|---|---|---|
| Metadata review or scanning | Instructions or suspicious patterns in tool names, descriptions, and schemas | Before a tool is offered to the agent | Does not rely solely on server identity or publisher reputation; examines the content |
| Runtime call and response validation | Calls the agent proposes and content returned by tools | During tool-call or response handling | Checks behavior and authorization rather than assuming a trusted tool will always be safe |
| Constrained permissions | Limits the actions and data available to the agent | At authorization and execution time | Restricts impact even if a malicious instruction influences the agent |
These layers address different points in the attack path; no universal benchmark establishes that one control works equally well across MCP clients and deployments. For background on the attack class and defenses, see Microsoft’s indirect prompt-injection guidance, Microsoft’s control-plane guidance, and the ShieldMCP paper.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the evidence does—and does not—show
Tool poisoning is a documented attack category, and the cited sources describe practical review and runtime defenses. They do not establish a prevalence rate for poisoned MCP servers, show that every client is vulnerable in the same way, or prove that every agent will follow malicious metadata. Nor do they identify one universal software patch that eliminates the attack class. The “nobody’s patching” framing should not be read as evidence that no mitigation exists: controls can reduce risk, but safe deployment depends on the client, server, tool permissions, and runtime environment.
Quick Recap
Best Value
- Milwaukee Ink all Fine Point Marker, Black, 4 Per Pack
- 4 per pack Features Clog Resistant Marker Tip Writes through Dusty, Wet and Oily Surfaces Durable Marker Tip for Writing on Concrete, OSB and Rough Surfaces
- Clog resistant tip writes on dusty, wet and oily surfaces and is optimized for rough surfaces such as OSB, cinderblock and concrete
- Hard hat clip- attaches for easy access
- Quick dry time with reduced smearing and marking
Rank #4
- Long Nib and Deep Hole Marker: Our mechanical carpenter pencil with 45mm nib is designed for easy marking of deep holes or narrow areas. These construction pencils are the great choice for woodworking tools, construction tools, carpenter tools, contractor tools, wood carpentry tools and architect tools
- Extra Refills in 2 Colors for Versatile Marking: The construction mechanical pencil comes with 12 extra 2.8mm refills, including 6 red and 6 black refills. The black refill is suitable for light surfaces, while the red wax is perfect for dark surfaces. Our carpenter mechanical pencil makes sure that you'll have an ample supply for extended use
- Built-in Sharpener: Our construction pencil comes with a built-in sharpener to ensure the mechanical pencil tip is always sharp and ready for use. Never buy an extra pencil sharpener again. A great tool for any woodworker pencil, contractor pencils. The refill can easily be extended or retracted with a simple click of the pencils mechanical, allowing you to work more efficiently and accurately
- Portable Clip Design: Our deep hole construction pencil features a portable clip design, easy to carry and attach to your pocket or tool box, so that you can keep the carpenter pencils mechanical close at hand, making it a convenient tool to have on the go. Great gifts choice for carpenters
- Stronger Pencil Lead: The black refills are made of lead, sturdy and smooth. The red refills are made of wax, clear and light. These marking pencils are much thicker and stronger than normal pencils during the marking process of construction work, suitable for various surfaces, such as glasses, metal, boards, floors, walls, furniture, etc. The written marks can be easily wiped with a wet paper towel when needed
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
