Skip to main content
Incorrect binding between agent, tool, or model causes misrouted calls or unintended privilege escalation.

​
How to resolve

Pin tool definitions with cryptographic hashes: Pin tool definitions using SHA-256 hashes at discovery time and re-verify the hash before every execution. Digitally sign tool manifests and schemas using JWS, COSE, or PKI-backed signatures, and reject any tool whose signature or hash does not match the trusted baseline. Maintain an immutable tool registry: Store tool schemas in a version-controlled registry with signed commits and multi-person approval for modifications. Enforce branch protections and separate the roles of proposing, approving, and publishing schema changes to prevent unauthorized tool rebinding. Enforce strict schema validation: Apply JSON Schema validation with additionalProperties: false on all tool parameters to prevent parameter tampering. Validate tool bindings programmatically to catch mismatches such as an archive operation incorrectly mapped to a destructive HTTP DELETE. Implement identity verification and human-in-the-loop: Use certificate-based authentication per agent type with short validity windows rather than shared secrets or inherited tokens. Bind permissions to subject, resource, purpose, and duration. Require human confirmation before executing sensitive or destructive operations, displaying full tool inputs for review.

​
Risk

Governance/Compliance Identity misbinding vulnerabilities violate multiple security standards:
  • OWASP Top 10 for LLM Applications (LLM06:2025 - Excessive Agency): Enables unintended privilege escalation through misrouted tool calls that bypass intended access boundaries.
  • NIST AI RMF (MAP-2.3): Fails to adequately map and manage the trust boundaries between AI components, allowing identity confusion across agents, tools, and models.
  • ISO/IEC 42001 (System Architecture and Integration Controls): Does not enforce proper component binding and identity verification between interconnected AI system elements.
  • OWASP MCP Top 10 (MCP03:2025 - Tool Poisoning): Ambiguous bindings enable tool substitution or interception by allowing multiple endpoints to serve the same tool identity.
Security Model/tool identity misbinding allows attackers to exploit ambiguous or inconsistent bindings to redirect tool invocations to malicious or unintended endpoints. When multiple endpoints are mapped to the same tool, the system may non-deterministically route calls to an attacker-controlled implementation. Inconsistent tool-to-server mappings can cause privilege escalation when a tool intended for a low-privilege context is bound to a high-privilege server. This is particularly dangerous in multi-server environments where binding resolution depends on registration order or configuration precedence that an attacker can influence.

​
Explanation

Incorrect binding between an agent, tool, or model causes the system to route calls to unintended endpoints or grant unintended privileges. This occurs when multiple endpoints are mapped to the same tool, or when tool-to-server mappings are inconsistent, leading to misrouted invocations that bypass intended access controls.

​
Specifications

Trigger
  • MCP server scan detects multiple endpoints mapped to the same tool, or inconsistent tool-to-server mappings that could cause misrouted invocations
Severity
  • HIGH
Applies to: MCP Server