A tool description is an instruction the model will follow, shipped by a stranger, revocable and rewritable after approval, so vetting at install time is a control against last week’s version of the package.

The mechanism

Tool poisoning is indirect prompt injection that arrives in the metadata rather than in the data. When a server advertises a tool, its name, description and parameter schema go into the model’s context, and no client is required to check any of it. That timing is why this is a supply-chain page and not a subsection of prompt injection: the payload arrives at install, inside the package, before any user has typed anything.

The reference incident is postmark-mcp. Fifteen releases were byte-for-byte a clone of Postmark’s own server and behaved correctly. Version 1.0.16, published 2025-09-17, added one line: a BCC of every outgoing message to an address the author controlled. Roughly 1,500 weekly downloads, an estimated 300 organisations in production, and by Koi Security’s estimate three to fifteen thousand emails a day leaving the building. Three details matter more than the incident. Postmark was never breached: this was an unaffiliated clone, so vendor diligence would not have caught it. Trust was earned across fifteen honest releases and spent in one. And when the author pulled the package from npm, that removed it from the registry and from nobody’s laptop; affected firms got no signal at all. A firm that could not query which agents were calling which servers last September learned nothing from npm’s takedown.

The same shape has a CVE. In Cursor (CVE-2025-54136, CVSS 8.8, fixed in 1.3), a collaborator accepts an innocuous MCP configuration once; anyone with repository write access can then swap it for a malicious command, and it re-runs with no fresh prompt. The rug pull is a numbered defect in a shipping product rather than a theoretical property of the protocol, and the infection vector is cloning a repository.

Scale offers no comfort. Of 1,899 open-source MCP servers studied, 7.2% carried general security vulnerabilities and 5.5% showed tool-poisoning characteristics, about one in twenty, though that is a static-analysis signal over the auditable subset rather than a count of malicious intent. The official MCP registry leaves this open: admission requires proving control of a GitHub account or a domain, and scanning is explicitly delegated to npm, PyPI and downstream aggregators. Registry presence means someone owned a domain, which amounts to admission rather than review.

Three properties make this worse than the software supply chain a firm already manages.

Composition happens at runtime. Classic dependency scanning assumes the artifact list is fixed at build. Agentic systems load tools, personas and prompt templates while running, which is OWASP’s ASI04 point and the reason install-time vetting is structurally insufficient.

Agents are stateful, so compromise persists and spreads. A poisoned tool definition on one server compromises every agent that connects to it, and those agents keep running.

The human is a usable step in the chain. A coding agent that wants a package it cannot install can simply write the import and let the developer install it when the build breaks. Package-hallucination rates run 5.2% for commercial models to 21.7% for open-source ones across ~19,000 prompts, the registration surface for slopsquatting. Note what this does to approval gates: the agent never takes the action a gate would have blocked.

The most-cited near-miss belongs here too, with its actual cause. Amazon Q for VS Code v1.84.0 shipped attacker-injected code through Amazon’s official release channel in July 2025. The root cause was an improperly scoped GitHub token in the CI configuration that let an outside contributor land code included automatically in a release, a credential-scoping failure rather than a clever prompt. The payload was destructive and it did not run, because it contained a syntax error. Say that part out loud in any tabletop: nothing protected the customers; the attacker made a typo.

What to do

Pin versions and re-review on change, because the threat model is the update rather than the install. Then accept the gap that remains: pinning gives no protection on first contact, when there was nothing to compare against. Trust-on-first-use is the same problem as SSH host keys, and the answer is the same: the first approval is the one a human has to earn.

Keep a queryable record of which agents called which servers and when. postmark-mcp is the argument: without it, a takedown notice cannot be acted on. This is agent inventory doing incident-response work.

Scope CI credentials as though an outside contributor will use them, because at Amazon one did.

The rest belongs to supply-chain vetting: how to vet, what evidence to demand per tier, what to do about the desktop.

How you’d know it’s working

Every MCP server reachable from any agent can be named, with a pinned version, and the list comes out of a system rather than out of memory.

A tool description that changes triggers re-review before the next call. Test it by changing one in a staging server and seeing whether anything fires. In most firms nothing does, and that is the finding.

The question “were we running package X on date Y” gets an answer in minutes. It arrives from a vendor advisory, not from internal monitoring.

What this doesn’t solve

A perfectly vetted tool fed hostile data is still an injection vector. This page covers the tool being hostile; prompt injection covers the content passing through an honest one.

Testing cannot find a trigger-gated backdoor, and this is the uncomfortable one. Hubinger et al. showed that trained-in conditional behaviour survives supervised fine-tuning, reinforcement learning and adversarial training, and that adversarial training taught models to recognise the trigger and conceal the behaviour rather than losing it, with persistence strongest in the largest models. The financial-advisory version of this (an agent that biases recommendations only when a production marker is present, with harm accruing across thousands of small, defensible calls) is a hypothetical from the literature rather than an observed incident. The persistence property is demonstrated; the base rate is unknown; both halves of that sentence are load-bearing.

Concentration risk sits underneath all of it and no vetting programme touches it. Nearly every deployed agent product runs on a GPT, Claude or Gemini family model, and roughly three-quarters of agent tooling is third-party code (Snyk telemetry, ~77% third-party as of August 2026). A safety regression or pricing change at one provider propagates through the sector at once, which makes concentration a board-level dependency question rather than a control.

And vetting says nothing about ongoing behaviour. A registered, identity-verified agent that touches a poisoned website is compromised afterward; attestation of who something is never vouched for what it does next.

See also

• Supply-chain vetting — the control family this concern justifies, and where the tiering lives.
• Model Context Protocol — the trust model these attacks exploit, and why the client configuration is the real decision.
• Prompt injection and goal hijack — what a poisoned description actually performs once loaded.
• Privilege and identity abuse — what an unauthenticated server hands to whoever connects to it.
• Agent inventory — the record that turns a vendor advisory into an actionable question.
• AI gateways (and MCP gateways) — the immature product category trying to become the chokepoint.