MCP tool poisoning

Tool descriptions are input to the agent. Treat their evolution as part of the trust boundary.

What deterministic checks can observe

Changes to descriptions, schemas and annotations are visible in exported tool manifests. Hidden or overriding instruction patterns can be identified without sending component contents to an LLM.

What checks cannot prove

Language interpretation is contextual. A static rule cannot establish every possible agent response, hidden server behavior or effective permission. Keep tool execution permissions narrow and independently review changed contracts.

What a clean result means

DriftSeal provides automated technical analysis and monitoring. It does not guarantee that software is secure. A clean DriftSeal result means only that no material issue or drift was detected by the active ruleset and coverage available during that scan.