FerentinFerentin
Home/Glossary/Tool Poisoning

Glossary

What is Tool Poisoning?

An attack in which malicious instructions are hidden in an MCP tool’s metadata, such as its name, description or input schema, which the model reads when deciding which tool to call and how. A poisoned description can tell the model to read a sensitive file and pass it as an argument, or to call a different tool instead.

In depth

Tool poisoning exploits the fact that an AI model treats tool descriptions as trusted guidance. The tool’s code may be harmless; the attack is in the text. A poisoned description might instruct the model to include the contents of an SSH key in a “notes” argument, to prefer this tool over a legitimate one, or to conceal what it is doing from the user. Attackers hide instructions with invisible Unicode characters, base64, or text far down a long description, and impersonate trusted servers with look-alike names (typosquatting). Because users rarely read full tool descriptions, the instructions reach the model without a human ever seeing them.

Why it matters

Every MCP server an organization connects adds text to the model’s context that the organization did not write. Without review, the catalog of approved tools becomes an injection channel with the model’s full trust. Defense works at two points: scan tool metadata when a server is added or changes, and enforce the verdict when a tool is called, not only when tools are listed, since a client can call a tool by name without ever listing it.

Common use cases

  • Scanning tool names, descriptions and schemas when an MCP server is added
  • Detecting invisible Unicode, encoded payloads and look-alike server names
  • Blocking a flagged tool at call time as well as hiding it from listings
  • Re-scanning a server’s tools when its definitions change
  • Recording each review decision with the reviewer’s reasoning

How Ferentin handles it

Ferentin is the trust layer for AI agents. The platform centralizes identity, policy enforcement and audit across LLMs, MCP servers and AI tools. Tool Poisoning is one of the primitives this trust layer is designed around. See the platform overview for how it fits into the service edge, control plane and observability plane.

Related terms

Prompt Injection

An attack technique where malicious input is crafted to override or manipulate the instructions given to a Large Language Model. In direct prompt injection, the attacker embeds adversarial text in a prompt to alter the model's behavior. In indirect prompt injection, the malicious payload is hidden in external data the model retrieves, such as web pages, documents or tool outputs. Prompt injection can lead to data exfiltration, unauthorized actions or bypassing safety guardrails, making input validation and output monitoring critical components of AI security.

Rug Pull

An MCP supply-chain attack in which a server behaves benignly while it is reviewed and approved, then changes its tool names, descriptions or behavior afterward. Because clients often re-read tool definitions on every connection, a changed description can carry new hidden instructions to the model with no further approval. Defenses include re-scanning a server’s definitions when they change, holding changed tools for re-review, and continuing to serve the previously approved definitions until a reviewer accepts the new ones.

MCP Gateway

A centralized control plane for Model Context Protocol traffic. An MCP gateway secures, manages and routes connections between AI agents and MCP servers, enforcing zero-trust access controls and providing visibility into every tool invocation.

Catalog

In AI infrastructure, a catalog is a centralized registry of available resources: AI clients (IDEs, copilots, chat interfaces), MCP servers (tool providers) and LLM providers with their available models. The catalog enables administrators to discover, organize and govern which resources are available to their organization, while giving users a self-service way to find and connect to approved AI services. A well-maintained catalog is foundational to AI governance, as it defines the boundary of what can be accessed and by whom.

Toxic Flow

A threat pattern unique to AI agents where the combination of tools and data in an agent's context becomes dangerous, even when each tool is safe on its own. Toxic flows arise when an agent chains actions together, such as reading sensitive data from one source and sending it to an external service. They enable prompt injection, data exfiltration and tool misuse. Detecting toxic flows requires context-aware policy enforcement that inspects not just the current request but the full sequence of tools invoked and the data in scope.

Add the trust layer to your AI stack

Zero trust policy enforcement from prompt to tool call. Get started in minutes.

Get Started FreeBook a Demo