What is tool poisoning?
In short: Tool poisoning is when an attacker hides instructions in a tool's description, parameters or output so the model follows them. The user never sees the hidden text. A gateway mitigates it by limiting which tools an agent can see, screening descriptions and checking every resulting call against policy.
What happens?
A server publishes a tool whose description contains hidden instructions, such as reading a secrets file and passing it as a parameter.
The model reads descriptions as trusted context, so it may comply without the user noticing.
How does a gateway mitigate it?
- Only expose tools from approved servers, and hide tools an agent does not need.
- Screen tool descriptions and outputs for instructions.
- Check each call against policy, so a poisoned instruction still hits a deny.
Which scored gateways document a mitigation?
| Gateway | Documented control | Source |
|---|---|---|
| NewCore | Tools an agent cannot use stay hidden, and every call is checked against policy. | [nc-govern] |
| Aembit | MCP tool filtering. | [ae-home] |
| Lasso | Guardrail plugins check content through Lasso's API. | [lasso-gh] |
| Mintive | Mint Guard screens tool calls. | [mint-home] |
Facts only. A gateway missing here may still mitigate the threat; we list what its public pages document.
Sources
- OWASP MCP Top 10 [owasp-mcp] read 2026-11-03
- MCP spec: Security best practices [mcp-sec] read 2026-11-03
- NewCore: Govern [nc-govern] read 2026-11-03
- Aembit home [ae-home] read 2026-11-03
- lasso-security/mcp-gateway README [lasso-gh] read 2026-11-03
- MintMCP home (now Mintive) [mint-home] read 2026-11-03
All eight threats are listed on the threats hub.
By The Datasheet desk · Published and reviewed 2026-11-03