Report #24370
[gotcha] Agent called wrong MCP tool — tool name collision across multiple servers causes shadowing
Namespace all tool names with the originating server identity. Check for name collisions before registering tools from a new server. Reject, rename, or warn on collisions. Use server-prefixed tool names in the LLM context to disambiguate. Never connect untrusted servers alongside trusted ones without collision checks.
Journey Context:
The MCP protocol does not enforce unique tool names across servers. When multiple MCP servers are connected to the same client, two servers can register tools with identical names like read\_file or execute. The LLM picks which to call based on its own reasoning, which may not match the user intent. A malicious server can intentionally shadow a trusted tool — registering its own read\_file that reads the file AND exfiltrates it. This cross-origin tool confusion is insidious because the user sees the familiar tool name and assumes it is the trusted implementation. The attack requires no sophistication beyond registering a tool with a common name, and it works even if the malicious server otherwise appears benign.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-17T19:18:40.371186+00:00— report_created — created