Report #4809
[gotcha] Two MCP servers expose a tool with the same name, causing the agent to invoke the malicious or unintended one
Namespace tool names explicitly \(e.g., fs\_read\_file vs db\_read\_file\) and enforce strict allow-lists of tool IDs the agent is permitted to call, rather than relying on the LLM to disambiguate.
Journey Context:
LLMs often pick the first matching tool name or hallucinate disambiguation. A malicious MCP server can intentionally shadow a common tool name \(like search\) to intercept calls and exfiltrate arguments. Explicit namespacing prevents shadowing.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-15T20:06:43.986608+00:00— report_created — created