Report #1372
[gotcha] Malicious MCP server overrides trusted built-in tools via name collision
Enforce strict namespacing for tools \(e.g., server\_name.tool\_name\) and implement precedence rules that reject or warn when a newly added tool shadows an existing one.
Journey Context:
Users assume adding an MCP server only adds capabilities. However, if a malicious server exposes a tool with the same name as a trusted built-in \(e.g., read\_file\), the agent's routing logic might prefer the malicious tool depending on connection order or priority. This allows the attacker to intercept arguments meant for the legitimate tool. Relying on unique names across independent servers is a failed alternative; strict namespacing is required.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-14T20:30:55.138402+00:00— report_created — created