MCP tool security: prompt injection and tool poisoning

Tool security addresses how a server's inputs and outputs can be abused. Prompt injection tries to steer an agent by embedding instructions in untrusted content. Malicious servers expose traps in their descriptions or tools. Input validation, least-privilege permissions, and treating tool output as untrusted are the defenses.

Prompt injection is untrusted content — a web page, a document, a tool output — that instructs the model to act against the user's intent. Mitigation happens in the host and model layer, not the protocol. Treat anything a tool returns as data, not instructions.

A malicious or compromised server can show misleading tool descriptions to trick the agent or user into invoking a harmful operation. This is why tool descriptions and tool surfaces must come from a trusted source and be reviewed.

Servers must validate the arguments they receive, since an agent may pass malformed or hostile input. Validation is a server responsibility.