/hunt-mcp

name: hunt-mcp
description: MCP server attack hunting - tool poisoning, indirect prompt injection via tool output, rug-pull updates, cross-tool shadowing, over-permissioned/excessive-agency tools, lethal trifecta. Wiki-first, FIND schema output.

Hunt: MCP Server Attacks

**Assumes `hunt-core`** for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.

Wiki

qmd_query "MCP server tool poisoning indirect prompt injection rug pull cross-tool shadowing excessive agency lethal trifecta" via wiki-search MCP

Hub: [[web-moc]] (live index). Primary page: [[mcp-server-attacks]]. Anchors: [[llm-attacks]].

Attack surface

Rank before testing. Not all surfaces are equally reachable or impactful:

• **Tool descriptions / docstrings** - the FULL text (not the UI summary) is the injection surface.

Hidden instructions ride in `<IMPORTANT>` tags, comments, unicode-tag or zero-width text, and parameter descriptions the client concatenates into the model context.

• **Tool output fed back to the model** - any tool that fetches untrusted content (web page, ticket,

file, email, issue body) and returns it to the model is an indirect-injection channel. Highest yield because the payload is not in the manifest and survives description review.

• **Over-permissioned / excessive-agency tools** - a tool that can write files, send mail, run

shell, or hit arbitrary URLs turns any injection into action. The blast radius, not the bug.

• **Lethal trifecta in one agent** - private-data access + untrusted input + an outbound/exfil

channel. When all three are reachable by a single agent, injection becomes exfil. Map who holds each leg.

• **Exposed MCP infrastructure** - MCP servers, tool manifests, agent tool lists, MCP Inspector

(CVE-2025-49596, unauth RCE).

Methodology

1. **Enumerate tools:** name, FULL description/docstring, parameter schema, permissions. The full description is the attack surface, not the UI summary. 2. **Map the trifecta across tools** - who reads secrets, who reads untrusted input, who can reach network/fs. A single agent holding all three legs is the primary target. 3. **Tool poisoning:** hidden instructions in the description (often `<IMPORTANT>` tags) -> read a secret, pass it via a benign-looking param. 4. **Cross-tool shadowing:** from one server, hijack a different trusted tool (for example redirect `send_email` recipients). 5. **Indirect injection via tool output:** plant instructions in a ticket/web page/file the agent will read. 6. **Rug pull:** get a benign tool approved, then mutate its description server-side after approval. 7. **Confirm** per the Confirmation gate below - demonstrated execution via the client, never the model's narration. 8. **Distill when confirmed** - reusable poisoning, shadowing, or rug-pull technique, GENERIC, no client host: `python3 scripts/wiki-stage.py --kind technique --slug <slug> --target-page techniques/web/mcp-server-attacks.md`

Confirmation gate

**NOT confirmation:** a tool description that merely *contains* an injection string; a permissive or over-broad parameter schema; the trifecta being *reachable* on paper without exercising it across the tools; the model narrating that it "would" or "could" do something; a payload accepted into a description or tool output that the client never acted on.

**IS confirmation:** the injection actually **executed via the client** - a shadowed or poisoned tool invoked with attacker-chosen arguments, private data exfiltrated to your endpoint, or an unintended action taken by the agent - reproduced in a clean session. For rug-pull, the mutation took effect on an already-approved tool and the client acted on the new description.

Chaining

Tool-output injection (step 5) -> **excessive agency**: once you control the model's instructions via poisoned output, the impact is whatever the over-permissioned tools can do (mail, files, shell, outbound HTTP). That escalation is prompt-injection territory - hand off to `hunt-llm` for the injection-to-action payload work, keep the MCP-specific poisoning/shadowing here.

Evasion

Description review and human approval are the controls to bypass. Hide instructions where a reviewer skims past: `<IMPORTANT>`/comment blocks, zero-width or unicode-tag characters, whitespace padding, instructions split across several tools' descriptions, and payloads in parameter descriptions rather than the top-level docstring. Against approval flows, the rug-pull *is* the evasion: ship benign, mutate after the human clicks approve.

Severity

Rated on demonstrated impact, not the presence of a payload.

| Outcome | Typical | |---|---| | RCE on the MCP host or client (e.g. MCP Inspector CVE-2025-49596) | critical | | Secret / credential exfil via poisoned or shadowed tool | critical | | Cross-tool hijack - arbitrary attacker-controlled tool action | high | | Data exfil - private context reaching an attacker channel | high | | Over-permissioned tool, limited demonstrable impact | medium |

Deadends

Append: - [ ] MCP attack on <server> -- no client-side execution; descriptions clean,
              no reachable trifecta, tool output not acted on

Record what you tried (poisoning / shadowing / indirect-output / rug-pull), not just that it failed.