MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCP

TL;DR

This paper introduces MCP-ITP, an automated framework that generates implicit tool poisoning attacks in MCP, significantly increasing attack success rates while evading detection, revealing vulnerabilities in LLM agent-tool interactions.

Contribution

MCP-ITP is the first automated, adaptive system for implicit tool poisoning in MCP, formulating poisoned tool creation as a black-box optimization problem with feedback from LLMs.

Findings

Achieves up to 84.2% attack success rate.

Suppresses detection rate to as low as 0.3%.

Outperforms manual poisoning baselines.

Abstract

To standardize interactions between LLM-based agents and their environments, the Model Context Protocol (MCP) was proposed and has since been widely adopted. However, integrating external tools expands the attack surface, exposing agents to tool poisoning attacks. In such attacks, malicious instructions embedded in tool metadata are injected into the agent context during MCP registration phase, thereby manipulating agent behavior. Prior work primarily focuses on explicit tool poisoning or relied on manually crafted poisoned tools. In contrast, we focus on a particularly stealthy variant: implicit tool poisoning, where the poisoned tool itself remains uninvoked. Instead, the instructions embedded in the tool metadata induce the agent to invoke a legitimate but high-privilege tool to perform malicious operations. We propose MCP-ITP, the first automated and adaptive framework for implicit tool poisoning within the MCP ecosystem. MCP-ITP formulates poisoned tool generation as a black-box optimization problem and employs an iterative optimization strategy that leverages feedback from both an evaluation LLM and a detection LLM to maximize Attack Success Rate (ASR) while evading current detection mechanisms. Experimental results on the MCPTox dataset across 12 LLM agents demonstrate that MCP-ITP consistently outperforms the manually crafted baseline, achieving up to 84.2% ASR while suppressing the Malicious Tool Detection Rate (MDR) to as low as 0.3%.