Untrusted MCP Servers and Tool Poisoning

A server controls the names, descriptions, schemas, prompts, and results it exposes. A malicious or compromised server can use those surfaces to influence an agent or request excessive access.

Trust before connect

Review the server's publisher, source, permissions, update mechanism, and requested credentials. Pin or verify packages where your deployment process supports it.

Do not grant broad credentials to test a server

Start with disposable or read-only access and a limited environment.

Filter exposed tools

A server may publish capabilities you do not intend to use. Allowlist the subset relevant to the agent.

Observe changes

If tool definitions change unexpectedly, cached catalogs and approval policies may no longer match your review. Monitor server upgrades and capability drift.