MCP Server Security: Tool Poisoning, Rug Pulls & Over-Broad Scopes
MCP lets an AI agent call real tools — databases, file systems, ticketing, email. That makes every MCP server a new piece of attack surface. Here is the checklist I use when reviewing one.
1. Read every tool description
Tool descriptions are fed straight to the model. A poisoned description can tell the agent to read secrets or send data elsewhere, and the user never sees it. Review descriptions like code.
2. Pin versions — watch for rug pulls
A server that was safe when you approved it can change later. Pin versions and hash the tool list, and alert when either changes.
3. Check scopes and permissions
Most servers ask for far more than they need.
- Read-only where possible
- Per-tool credentials, not one admin token
- No shell or file-system tools unless essential
- Separate servers for separate trust levels
4. Look for tool shadowing
When several servers are connected, one can define a tool with a similar name or description to hijack calls meant for another. Namespace tools and review the combined tool list, not just each server alone.
5. Trace the data flow
Draw where data enters (tool output) and where it can leave (any tool that sends, writes or fetches). Untrusted tool output feeding a tool that can send data out is your highest-risk path.
Tooling
MCP Inspector lets you see exactly what a server exposes; mcp-scan flags known poisoning patterns. Neither replaces reading the descriptions yourself.
Tools mentioned
Treat every MCP server like a third-party dependency with production credentials — because that's what it is.