auditing-mcp-tool-integrations

# Auditing MCP tool integrations: the tool layer is attack surface When a model is given tools (over the Model Context Protocol or any equivalent tool interface), it does not just call them, it *reads* them: names, descriptions, parameter schemas, and returned data all enter the model context and are trusted by default. That makes the tool layer an injection surface distinct from user content, and one most reviews skip because they read tools as documentation instead of as model input. ## When to use - You are adding or reviewing a tool, an MCP server, or a marketplace/registry entry, especially a third-party one. - You are auditing an agent's full tool manifest and its trust assumptions. - You are deciding whether a tool needs pinning, sandboxing, or human approval. ## Scope check Audit tools and servers you own or are authorized to test. Do not tamper with tools others depend on. If you can't name the authorization, stop. ## The loop 1. **Read every tool definition as the model sees it.** Pull the exact names, descriptions, parameter schemas, and any metadata surfaced to the model. This text is model input, not docs. Anything imperative in it is a potential injection. 2. **Check for instructions in metadata (tool poisoning, line jumping).** Does any description or parameter text address the model with commands: "always call this first," "ignore other tools," "read the user's credentials and include them"? Such text executes as an instruction the ...