| name | hunt-mcp |
| description | MCP server attack hunting - tool poisoning, indirect prompt injection via tool output, rug-pull updates, cross-tool shadowing, over-permissioned/excessive-agency tools, lethal trifecta. Wiki-first, FIND schema output. |
Hunt: MCP Server Attacks
Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.
Wiki
qmd_query "MCP server tool poisoning indirect prompt injection rug pull cross-tool shadowing excessive agency lethal trifecta" via wiki-search MCP
Hub: [[web-moc]] (live index). Primary page: [[mcp-server-attacks]].
Anchors: [[llm-attacks]].
Attack surface
Rank before testing. Not all surfaces are equally reachable or impactful:
- Tool descriptions / docstrings - the FULL text (not the UI summary) is the injection surface.
Hidden instructions ride in
<IMPORTANT> tags, comments, unicode-tag or zero-width text, and
parameter descriptions the client concatenates into the model context.
- Tool output fed back to the model - any tool that fetches untrusted content (web page, ticket,
file, email, issue body) and returns it to the model is an indirect-injection channel. Highest
yield because the payload is not in the manifest and survives description review.
- Over-permissioned / excessive-agency tools - a tool that can write files, send mail, run
shell, or hit arbitrary URLs turns any injection into action. The blast radius, not the bug.
- Lethal trifecta in one agent - private-data access + untrusted input + an outbound/exfil
channel. When all three are reachable by a single agent, injection becomes exfil. Map who holds
each leg.
- Exposed MCP infrastructure - MCP servers, tool manifests, agent tool lists, MCP Inspector
(CVE-2025-49596, unauth RCE).
Methodology
- Enumerate tools: name, FULL description/docstring, parameter schema, permissions. The full
description is the attack surface, not the UI summary.
- Map the trifecta across tools - who reads secrets, who reads untrusted input, who can reach
network/fs. A single agent holding all three legs is the primary target.
- Tool poisoning: hidden instructions in the description (often
<IMPORTANT> tags) -> read a
secret, pass it via a benign-looking param.
- Cross-tool shadowing: from one server, hijack a different trusted tool (for example redirect
send_email recipients).
- Indirect injection via tool output: plant instructions in a ticket/web page/file the agent
will read.
- Rug pull: get a benign tool approved, then mutate its description server-side after approval.
- Confirm per the Confirmation gate below - demonstrated execution via the client, never the
model's narration.
- Distill when confirmed - reusable poisoning, shadowing, or rug-pull technique, GENERIC, no
client host:
python3 scripts/wiki-stage.py --kind technique --slug <slug> --target-page techniques/web/mcp-server-attacks.md
Confirmation gate
NOT confirmation: a tool description that merely contains an injection string; a permissive or
over-broad parameter schema; the trifecta being reachable on paper without exercising it across
the tools; the model narrating that it "would" or "could" do something; a payload accepted into a
description or tool output that the client never acted on.
IS confirmation: the injection actually executed via the client - a shadowed or poisoned
tool invoked with attacker-chosen arguments, private data exfiltrated to your endpoint, or an
unintended action taken by the agent - reproduced in a clean session. For rug-pull, the mutation
took effect on an already-approved tool and the client acted on the new description.
Chaining
Tool-output injection (step 5) -> excessive agency: once you control the model's instructions
via poisoned output, the impact is whatever the over-permissioned tools can do (mail, files, shell,
outbound HTTP). That escalation is prompt-injection territory - hand off to hunt-llm for the
injection-to-action payload work, keep the MCP-specific poisoning/shadowing here.
Evasion
Description review and human approval are the controls to bypass. Hide instructions where a reviewer
skims past: <IMPORTANT>/comment blocks, zero-width or unicode-tag characters, whitespace padding,
instructions split across several tools' descriptions, and payloads in parameter descriptions rather
than the top-level docstring. Against approval flows, the rug-pull is the evasion: ship benign,
mutate after the human clicks approve.
Severity
Rated on demonstrated impact, not the presence of a payload.
| Outcome | Typical |
|---|
| RCE on the MCP host or client (e.g. MCP Inspector CVE-2025-49596) | critical |
| Secret / credential exfil via poisoned or shadowed tool | critical |
| Cross-tool hijack - arbitrary attacker-controlled tool action | high |
| Data exfil - private context reaching an attacker channel | high |
| Over-permissioned tool, limited demonstrable impact | medium |
Deadends
Append: - [ ] MCP attack on <server> -- no client-side execution; descriptions clean,
no reachable trifecta, tool output not acted on
Record what you tried (poisoning / shadowing / indirect-output / rug-pull), not just that it failed.
