cd /news/ai-safety/finally-mcp-s-tool-poisoning-gap-sol… · home topics ai-safety article
[ARTICLE · art-33419] src=github.com ↗ pub= topic=ai-safety verified=true sentiment=↑ positive

Finally MCP's Tool Poisoning Gap Solved: A Protocol-Level Defense

A new protocol-level defense against tool poisoning in the Model Context Protocol (MCP) has been proposed, using signed tool manifests to detect unauthorized changes to tool descriptions between approval and reconnect. The proposal, submitted by RajSidwadkar, addresses a known security gap and includes a working reference implementation. Community feedback suggests combining this with runtime execution records for end-to-end tamper-evidence.

read1 min views1 publishedJun 19, 2026
[RajSidwadkar](/RajSidwadkar)started this conversation in

[Ideas - Security](/modelcontextprotocol/modelcontextprotocol/discussions/categories/ideas-security)

ProblemMCP's security guidance already flags a gap: a server's tool descriptions can ## ProposalI put together a small proposal + working reference implementation for an #

The demo signs a tool manifest, then simulates a server silently editing a ## Looking for feedback on Posting here first before considering a formal SEP draft, happy to adjust |

Beta Was this translation helpful?

Give feedback.

Replies: 1 comment 10 replies #

| Signed manifests close a real hole. Detecting that the tool description changed between approval and reconnect is exactly the rug-pull case the security guidance flags. Worth doing. One thing it leaves open: a signed manifest proves the description did not change, it does not prove what the tool actually did when called. A tool can keep an honest, signed manifest and still behave differently at runtime. The two layers compose cleanly: your signed manifest at admission, plus a signed per-call execution record at runtime, gives tamper-evidence across the whole lifecycle rather than just at connect time. I have been building the runtime half as an open SEP (2828), a hash-chained signed record of each tool call bound to the decision that authorized it. Different layer from yours, same Ed25519 toolbox. There is a real question of where the manifest signature and the call record should reference each other, and that is worth working out. |

Beta Was this translation helpful? Give feedback.

── more in #ai-safety 4 stories · sorted by recency
── more on @model context protocol 3 stories trending now
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
Live at https://your-agent.zahid.host
Get free account → Pricing
from €0/mo · no card required
LIVE [news/finally-mcp-s-tool-p…] indexed:0 read:1min 2026-06-19 ·