Hunt MCP Agent Skill

Hunt: MCP Server Attacks

Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.

Wiki

qmd_query "MCP server tool poisoning indirect prompt injection rug pull cross-tool shadowing excessive agency lethal trifecta" via wiki-search MCP

Hub: [[web-moc]] (live index). Primary page: [[mcp-server-attacks]].

Anchors: [[llm-attacks]].

Attack surface

Rank before testing. Not all surfaces are equally reachable or impactful:

• Tool descriptions / docstrings - the FULL text (not the UI summary) is the injection surface.

Hidden instructions ride in <IMPORTANT> tags, comments, unicode-tag or zero-width text, and

parameter descriptions the client concatenates into the model context.

• Tool output fed back to the model - any tool that fetches untrusted content (web page, ticket,

file, email, issue body) and returns it to the model is an indirect-injection channel. Highest

yield because the payload is not in the manifest and survives description review.

• Over-permissioned / excessive-agency tools - a tool that can write files, send mail, run

shell, or hit arbitrary URLs turns any injection into action. The blast radius, not the bug.

• Lethal trifecta in one agent - private-data access + untrusted input + an outbound/exfil

channel. When all three are reachable by a single agent, injection becomes exfil. Map who holds

each leg.

• Exposed MCP infrastructure - MCP servers, tool manifests, agent tool lists, MCP Inspector

(CVE-2025-49596, unauth RCE).

Methodology

• Enumerate tools: name, FULL description/docstring, parameter schema, permissions. The full

description is the attack surface, not the UI summary.

• Map the trifecta across tools - who reads secrets, who reads untrusted input, who can reach

network/fs. A single agent holding all three legs is the primary target.

• Tool poisoning: hidden instructions in the description (often <IMPORTANT> tags) -> read a

secret, pass it via a benign-looking param.

• Cross-tool shadowing: from one server, hijack a different trusted tool (for example redirect

send_email recipients).

• Indirect injection via tool output: plant instructions in a ticket/web page/file the agent

will read.

• Rug pull: get a benign tool approved, then mutate its description server-side after approval.
• Confirm per the Confirmation gate below - demonstrated execution via the client, never the

model's narration.

• Distill when confirmed - reusable poisoning, shadowing, or rug-pull technique, GENERIC, no

client host: python3 scripts/wiki-stage.py --kind technique --slug <slug> --target-page techniques/web/mcp-server-attacks.md

Confirmation gate

NOT confirmation: a tool description that merely *contains* an injection string; a permissive or

over-broad parameter schema; the trifecta being *reachable* on paper without exercising it across

the tools; the model narrating that it "would" or "could" do something; a payload accepted into a

description or tool output that the client never acted on.

IS confirmation: the injection actually executed via the client - a shadowed or poisoned

tool invoked with attacker-chosen arguments, private data exfiltrated to your endpoint, or an

unintended action taken by the agent - reproduced in a clean session. For rug-pull, the mutation

took effect on an already-approved tool and the client acted on the new description.

Chaining

Tool-output injection (step 5) -> excessive agency: once you control the model's instructions

via poisoned output, the impact is whatever the over-permissioned tools can do (mail, files, shell,

outbound HTTP). That escalation is prompt-injection territory - hand off to hunt-llm for the

injection-to-action payload work, keep the MCP-specific poisoning/shadowing here.

Evasion

Description review and human approval are the controls to bypass. Hide instructions where a reviewer

skims past: <IMPORTANT>/comment blocks, zero-width or unicode-tag characters, whitespace padding,

instructions split across several tools' descriptions, and payloads in parameter descriptions rather

than the top-level docstring. Against approval flows, the rug-pull *is* the evasion: ship benign,

mutate after the human clicks approve.

Severity

Rated on demonstrated impact, not the presence of a payload.

| Outcome | Typical |

|---|---|

| RCE on the MCP host or client (e.g. MCP Inspector CVE-2025-49596) | critical |

| Secret / credential exfil via poisoned or shadowed tool | critical |

| Cross-tool hijack - arbitrary attacker-controlled tool action | high |

| Data exfil - private context reaching an attacker channel | high |

| Over-permissioned tool, limited demonstrable impact | medium |

Deadends

Append: - [ ] MCP attack on <server> -- no client-side execution; descriptions clean,
              no reachable trifecta, tool output not acted on

Record what you tried (poisoning / shadowing / indirect-output / rug-pull), not just that it failed.