> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Model/tool identity misbinding

> Incorrect binding between agent, tool, or model causes misrouted calls or unintended privilege escalation.

Incorrect binding between agent, tool, or model causes misrouted calls or unintended privilege escalation.

## How to resolve

**Pin tool definitions with cryptographic hashes**: Pin tool definitions using SHA-256 hashes at discovery time and re-verify the hash before every execution. Digitally sign tool manifests and schemas using JWS, COSE, or PKI-backed signatures, and reject any tool whose signature or hash does not match the trusted baseline.

**Maintain an immutable tool registry**: Store tool schemas in a version-controlled registry with signed commits and multi-person approval for modifications. Enforce branch protections and separate the roles of proposing, approving, and publishing schema changes to prevent unauthorized tool rebinding.

**Enforce strict schema validation**: Apply JSON Schema validation with `additionalProperties: false` on all tool parameters to prevent parameter tampering. Validate tool bindings programmatically to catch mismatches such as an `archive` operation incorrectly mapped to a destructive HTTP `DELETE`.

**Implement identity verification and human-in-the-loop**: Use certificate-based authentication per agent type with short validity windows rather than shared secrets or inherited tokens. Bind permissions to subject, resource, purpose, and duration. Require human confirmation before executing sensitive or destructive operations, displaying full tool inputs for review.

## Risk

**Governance/Compliance**

Identity misbinding vulnerabilities violate multiple security standards:

* **OWASP Top 10 for LLM Applications (LLM06:2025 - Excessive Agency):** Enables unintended privilege escalation through misrouted tool calls that bypass intended access boundaries.
* **NIST AI RMF (MAP-2.3):** Fails to adequately map and manage the trust boundaries between AI components, allowing identity confusion across agents, tools, and models.
* **ISO/IEC 42001 (System Architecture and Integration Controls):** Does not enforce proper component binding and identity verification between interconnected AI system elements.
* **OWASP MCP Top 10 (MCP03:2025 - Tool Poisoning):** Ambiguous bindings enable tool substitution or interception by allowing multiple endpoints to serve the same tool identity.

**Security**

Model/tool identity misbinding allows attackers to exploit ambiguous or inconsistent bindings to redirect tool invocations to malicious or unintended endpoints. When multiple endpoints are mapped to the same tool, the system may non-deterministically route calls to an attacker-controlled implementation. Inconsistent tool-to-server mappings can cause privilege escalation when a tool intended for a low-privilege context is bound to a high-privilege server. This is particularly dangerous in multi-server environments where binding resolution depends on registration order or configuration precedence that an attacker can influence.

## Explanation

Incorrect binding between an agent, tool, or model causes the system to route calls to unintended endpoints or grant unintended privileges. This occurs when multiple endpoints are mapped to the same tool, or when tool-to-server mappings are inconsistent, leading to misrouted invocations that bypass intended access controls.

## Specifications

**Trigger**

* MCP server scan detects multiple endpoints mapped to the same tool, or inconsistent tool-to-server mappings that could cause misrouted invocations

**Severity**

* HIGH

**Applies to**: MCP Server