Skip to main content
A malicious MCP server defines a tool with the same name and signature as a tool from a trusted server, enabling it to intercept or override legitimate tool calls.

​
How to resolve

Implement namespace isolation: Use fully-qualified tool names that include the server identifier (e.g., server1.tool_name vs server2.tool_name) to prevent naming conflicts. Enforce server priority and allowlists: Configure explicit server priority ordering and maintain allowlists of trusted servers. Reject or flag tools from untrusted or lower-priority servers that shadow trusted tool names. Validate tool provenance: Before invoking any tool, verify which server provides it and confirm that server is authorized to expose that functionality. Monitor for suspicious duplicates: Implement automated detection of duplicate tool names across servers and alert security teams when new servers introduce tools that shadow existing trusted tools.

​
Risk

Governance/Compliance Cross-server tool shadowing vulnerabilities violate multiple security standards:
  • OWASP Top 10 for LLM Applications (LLM03:2025, LLM06:2025): Exploits supply chain vulnerabilities and excessive agency by allowing malicious servers to impersonate trusted tools.
  • NIST AI RMF (MAP-4): Fails to manage third-party AI component risks.
  • ISO/IEC 42001 (Asset Management and Third-Party Controls): Does not enforce proper asset management or third-party controls to prevent tool name collisions across servers.
  • EU AI Act (Articles 9, 15): Violates risk management and technical documentation requirements by allowing unverified tool substitution.
  • OWASP MCP Top 10 (MCP03:2025 - Tool Poisoning): Enables introduction of fake or duplicate tools to intercept or alter interactions between clients and legitimate servers.
Security Tool shadowing enables attackers to intercept sensitive operations by masquerading as trusted tools. When the LLM or application invokes a tool by name, the malicious server’s implementation executes instead of the legitimate one, allowing data exfiltration, privilege escalation, or execution of unauthorized commands. This is particularly dangerous in environments where tool selection is based on name matching without strict namespace isolation or server verification.

​
Explanation

Also known as “Tool Hijacking,” this attack exploits ambiguity in tool resolution when multiple servers expose identically-named tools, allowing attackers to replace honest implementations by malicious ones.

​
Specifications

Trigger
  • MCP server scan detects duplicate tool names across different servers, where multiple servers expose tools with identical or highly similar names and signatures
Severity
  • CRITICAL
Applies to: MCP Server