Scan Your MCP Server for Tool Poisoning: A Practical Walkthrough

Description and use

A practical walkthrough for scanning MCP servers for tool poisoning using the sentinel-scan-cli static analyzer. It covers detecting and fixing injection patterns in tool descriptions, name shadowing, and excessive agency schemas.

Problem

MCP tool descriptions and schemas can contain hidden instructions (tool poisoning) or excessive agency flags that exploit LLM agents, leading to prompt injection attacks like SSH key exfiltration or unauthorized actions. Most developers do not manually audit these fields.

Outcome

The walkthrough demonstrates how to use sentinel-scan-cli to identify four types of MCP tool poisoning: description injection, name shadowing, excessive agency schemas, and indirect injection surfaces. It provides specific JSON fixes for each issue, resulting in a secure manifest.

Workflow

• Install the sentinel-scan-cli tool via pip.
• Run the scanner against a demo manifest using the --demo flag to understand output patterns.
• Run the scanner against your actual MCP manifest file (e.g., mcp.json).
• Analyze findings for tool_description_injection: Remove imperative language and system tags from descriptions.
• Analyze findings for tool_name_shadowing: Rename tools to avoid homoglyphs or collisions with built-in tools.
• Analyze findings for excessive_agency_schema: Constrain input parameters with enums, remove bypass flags, and set additionalProperties to false.
• Analyze findings for indirect_injection_surface: Architecturally separate data ingestion tools from action tools or implement confirmation gates.
• Re-run the scan to verify the fixes.

Evidence

Invariant Labs first documented 'MCP tool poisoning' in April 2025... It's now its own line item under prompt injection in the OWASP LLM Top 10 (2025), category LLM01.

Source

sentinel-scan mcp --demo ... 8 finding(s) in 5 tool(s)

Source