Skip to main content
Tool definition or MCP server descriptor has been modified to redirect agent actions

​
How to resolve

Verify tool definitions against a trusted registry. Pin tool versions and validate checksums. Monitor for changes to tool schemas at runtime.

​
Risk

Governance/Compliance This vulnerability falls under ASI02:2026 — Tool Misuse and Exploitation in the OWASP Top 10 for Agentic Applications. Agent uses legitimate tools in unsafe ways due to over-privilege, bad input, or poisoned descriptors. Security Tool definition or MCP server descriptor has been modified to redirect agent actions. If exploited, this can compromise the agent’s integrity, confidentiality, or availability, potentially affecting downstream systems and data.

​
Explanation

Tool definition or MCP server descriptor has been modified to redirect agent actions. This falls under ASI02 (Tool Misuse and Exploitation): Agent uses legitimate tools in unsafe ways due to over-privilege, bad input, or poisoned descriptors.

​
Specifications

Trigger
  • Agent scan detects tool definition or MCP server descriptor has been modified to redirect agent actions
The scanner looks for patterns such as:
  • tool definition loaded from external or unverified source
  • MCP server URL not pinned or verified
  • dynamic tool registration without manifest signing
Severity
  • HIGH
Applies to: Agent