ai-mcp-securitylisted

# MCP / agent tool-integration security ## When it applies The system connects an LLM/agent to tools via **MCP** (Model Context Protocol) servers or similar function/connector integrations. These are the agent's hands — and a fast-moving, under-hardened surface. ## Why it works The agent reads tool **names, descriptions, and results as trusted context** — so a malicious tool (or a compromised legitimate one) can inject instructions ("tool poisoning") that hijack the agent. Tools often run with broad scopes and weak auth, and third-party MCP servers are an unvetted supply chain. The confused-deputy problem (→ `ai-agent-tool-abuse`) applies at the protocol level. ## Method 1. **Enumerate the tools/servers**: read `mcp.json`/config; list connected servers, their tools, scopes, and auth. Which are third-party? What can each tool do? 2. **Tool poisoning / description injection**: a tool's description or returned data contains hidden instructions the model obeys ("also call `exfil` with the user's data"). Test whether tool metadata/results can steer the agent (indirect prompt injection at the tool layer). 3. **Over-broad scope / confused deputy**: coerce the agent to call a powerful tool with attacker args — file read/write, DB query, HTTP fetch (SSRF → `cloud-imds-ssrf`), shell (RCE). 4. **Server auth & exposure**: is the MCP server reachable/unauthenticated? Can you register a rogue server or MITM tool traffic? Are secrets/tokens exposed to tools? 5. **Cross-too