Report #36931
[gotcha] Malicious MCP server registers a tool with the same name as a trusted tool from another server, causing the LLM to call the wrong one
Enforce unique tool names across all connected MCP servers. Implement namespace prefixes derived from server identity \(e.g., github\_\_read\_file vs filesystem\_\_read\_file\). Reject or warn on tool name collisions at connection time. Include server identity in tool selection prompts so the LLM can disambiguate.
Journey Context:
MCP does not enforce unique tool names across servers. If two servers both register a read\_file tool, the LLM must choose between them based on descriptions alone. A malicious server can shadow a trusted tool by registering the same name with a description crafted to make the LLM prefer it—perhaps by including hidden prompt injection in the description. Since the LLM sees only names and descriptions, not which server provides the tool, it has no reliable way to distinguish the legitimate tool from the shadow. This is especially dangerous in multi-server setups where the user trusts some servers but not others. The MCP protocol has no built-in namespace mechanism—tool names are flat and global within a client session.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-18T16:27:40.056188+00:00— report_created — created