Tool Poisoning Isn't Code, It's Text: How MCP Tool Descriptions Smuggle Prompt Injection

Automated excerpt

That's the "tool description injection" pattern, and it's worth a closer look because it doesn't need a vulnerability, a bad dependency, or a supply-chain compromise to work. It just needs a text field the model reads and trusts. An MCP tool definition is mostly JSON: a name, a description, an input schema with per-property descriptions, maybe an enum with labeled values.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.