Hunt: MCP Server Attacks

Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.

Wiki

qmd_query "MCP server tool poisoning indirect prompt injection rug pull cross-tool shadowing excessive agency lethal trifecta" via wiki-search MCP

Hub: [[web-moc]] (live index). Primary page: [[mcp-server-attacks]]. Anchors: [[llm-attacks]].

Attack surface

Rank before testing. Not all surfaces are equally reachable or impactful:

• Tool descriptions / docstrings - the FULL text (not the UI summary) is the injection surface. Hidden instructions ride in <IMPORTANT> tags, comments, unicode-tag or zero-width text, and parameter descriptions the client concatenates into the model context.
• Tool output fed back to the model - any tool that fetches untrusted content (web page, ticket, file, email, issue body) and returns it to the model is an indirect-injection channel. Highest yield because the payload is not in the manifest and survives description review.
• Over-permissioned / excessive-agency tools - a tool that can write files, send mail, run shell, or hit arbitrary URLs turns any injection into action. The blast radius, not the bug.
• Lethal trifecta in one agent - private-data access + untrusted input + an outbound/exfil channel. When all three are reachable by a single agent, injection becomes exfil. Map who holds each leg.
• Exposed MCP infrastructure - MCP servers, tool manifests, agent tool lists, MCP Inspector (CVE-2025-49596, unauth RCE).

Methodology

1. Enumerate tools: name, FULL description/docstring, parameter schema, permissions. The full description is the attack surface, not the UI summary.
2. Map the trifecta across tools - who reads secrets, who reads untrusted input, who can reach network/fs. A single agent holding all three legs is the primary target.
3. Tool poisoning: hidden instructions in the description (often <IMPORTANT> tags) -> read a secret, pass it via a benign-looking param.
4. Cross-tool shadowing: from one server, hijack a different trusted tool (for example redirect send_email recipients).
5. Indirect injection via tool output: plant instructions in a ticket/web page/file the agent will read.
6. Rug pull: get a benign tool approved, then mutate its description server-side after approval.
7. Confirm per the Confirmation gate below - demonstrated execution via the client, never the model's narration.
8. Distill when confirmed - reusable poisoning, shadowing, or rug-pull technique, GENERIC, no client host: python3 scripts/wiki-stage.py --kind technique --slug <slug> --target-page techniques/web/mcp-server-attacks.md

Confirmation gate

NOT confirmation: a tool description that merely contains an injection string; a permissive or over-broad parameter schema; the trifecta being reachable on paper without exercising it across the tools; the model narrating that it "would" or "could" do something; a payload accepted into a description or tool output that the client never acted on.

IS confirmation: the injection actually executed via the client - a shadowed or poisoned tool invoked with attacker-chosen arguments, private data exfiltrated to your endpoint, or an unintended action taken by the agent - reproduced in a clean session. For rug-pull, the mutation took effect on an already-approved tool and the client acted on the new description.

Chaining

Tool-output injection (step 5) -> excessive agency: once you control the model's instructions via poisoned output, the impact is whatever the over-permissioned tools can do (mail, files, shell, outbound HTTP). That escalation is prompt-injection territory - hand off to hunt-llm for the injection-to-action payload work, keep the MCP-specific poisoning/shadowing here.

Evasion

Description review and human approval are the controls to bypass. Hide instructions where a reviewer skims past: <IMPORTANT>/comment blocks, zero-width or unicode-tag characters, whitespace padding, instructions split across several tools' descriptions, and payloads in parameter descriptions rather than the top-level docstring. Against approval flows, the rug-pull is the evasion: ship benign, mutate after the human clicks approve.

Severity

Rated on demonstrated impact, not the presence of a payload.

Outcome	Typical
RCE on the MCP host or client (e.g. MCP Inspector CVE-2025-49596)	critical
Secret / credential exfil via poisoned or shadowed tool	critical
Cross-tool hijack - arbitrary attacker-controlled tool action	high
Data exfil - private context reaching an attacker channel	high
Over-permissioned tool, limited demonstrable impact	medium

Deadends

Append: - [ ] MCP attack on <server> -- no client-side execution; descriptions clean,
              no reachable trifecta, tool output not acted on

Record what you tried (poisoning / shadowing / indirect-output / rug-pull), not just that it failed.