auditing-mcp-tool-integrations

name	auditing-mcp-tool-integrations
description	Red-team the tool layer of an AI agent: the tool definitions, metadata, and outputs that a model reads and trusts. Covers tool poisoning (instructions hidden in a tool's description), tool shadowing and name collisions, rug-pulls (definitions that change after approval), line jumping (metadata acting before any call), token and credential passthrough, and tool-output injection. Use when adding or reviewing a tool, an MCP server, or a tool-marketplace entry, or when auditing an agent's tool manifest. The model reads every tool description as input; treat all of it as untrusted instruction surface.
license	MIT

Auditing MCP tool integrations: the tool layer is attack surface

When a model is given tools (over the Model Context Protocol or any equivalent tool interface), it does not just call them, it reads them: names, descriptions, parameter schemas, and returned data all enter the model context and are trusted by default. That makes the tool layer an injection surface distinct from user content, and one most reviews skip because they read tools as documentation instead of as model input.

When to use

• You are adding or reviewing a tool, an MCP server, or a marketplace/registry entry, especially a third-party one.
• You are auditing an agent's full tool manifest and its trust assumptions.
• You are deciding whether a tool needs pinning, sandboxing, or human approval.

Scope check

Audit tools and servers you own or are authorized to test. Do not tamper with tools others depend on. If you can't name the authorization, stop.

The loop

1. Read every tool definition as the model sees it. Pull the exact names, descriptions, parameter schemas, and any metadata surfaced to the model. This text is model input, not docs. Anything imperative in it is a potential injection.