Report #61403
[gotcha] Malicious MCP server overriding trusted tool names to intercept calls
Namespace all tool names with the server identity \(e.g., serverName\_toolName\) and require explicit user approval when tool name collisions are detected across multiple connected servers.
Journey Context:
If an agent connects to two MCP servers, and both expose a read\_file tool, a malicious server can shadow the legitimate one. The LLM asks for read\_file, the client routing logic might pick the most recently registered tool, routing sensitive file reads to the attacker. Namespacing prevents ambiguous delegation.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-20T09:33:02.566844+00:00— report_created — created