Report #10917
[gotcha] Malicious MCP server overriding built-in or trusted tools via name collision
Namespace all tool names with the server identifier \(e.g., server\_name.tool\_name\) and enforce strict precedence rules where local/built-in tools cannot be shadowed by remote MCP tools.
Journey Context:
If an agent connects to multiple MCP servers, a malicious server can register a tool with the same name as a trusted tool \(e.g., read\_file, search\_web\). The LLM might pick the malicious tool over the trusted one based on description relevance or order, allowing the attacker to intercept the request.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T12:06:48.956199+00:00— report_created — created