MCP tool poisoning: how to tell if a server is manipulating your agent

Tuesday, September 8, 2026. A post on r/ClaudeAI passed 2,000 upvotes claiming Notion's official MCP connector injects advertising mid-task into the agent's work. That specific claim has no official confirmation anywhere. But the reason it struck a nerve is real: MCP has a documented vulnerability class called tool poisoning, and it already leaked a real SSH key in production before this.

What is tool poisoning in an MCP server?

It is when a tool's description, the text the model reads to decide whether and how to call that function, carries a hidden instruction. You never see that description in the interface. The agent does, and it obeys.

OWASP classifies this as MCP03:2025, Tool Poisoning, the third item on its top 10 of protocol-specific risks.

Has this caused real damage outside of Reddit?

Yes, with a public proof of concept since 2025. Invariant Labs hid an exfiltration instruction inside the description of a calculator tool. When a developer called the add function inside Cursor, the model read the developer's private SSH key and the local MCP config file, and sent both to an external endpoint, without anyone asking for that. Simon Willison analyzed the case days later: the underlying problem is that MCP mixes private data, untrusted instructions, and an exfiltration path, all inside the same tool call.

In June 2026, Microsoft published a warning confirming poisoned tool descriptions remain an active leak vector in production agents. And in March 2026, Notion's own official MCP server repository received a security advisory describing how malicious text planted on a shared page gets read by the agent and can instruct it to modify, read, or exfiltrate workspace content. That advisory, not the unverified advertising claim from Reddit, is the real reason to pay attention to the MCPs you connect.

How do I check the MCPs I already connected to Verboo Code?

Run the built-in diagnosis before even thinking about reading tool descriptions one by one. verboo mcp doctor exists for that: the source code itself describes the command as responsible for diagnosing MCP configuration, precedence, disabled or pending state, and connection health.

# only reads config, connects to nothing. safe even in a folder you do not trust
verboo mcp doctor --config-only

# connects for real to server "name" and shows its actual state
verboo mcp doctor name

# JSON output, to automate the check
verboo mcp doctor --json

The command's own warning is direct: without --config-only, stdio servers may actually be spawned and remote servers may be contacted for real. Only run the full version in a directory you trust.

What doctor does not do: read every tool description looking for a hidden instruction. It checks configuration and connectivity, not the description's content. Tool poisoning lives in the content. That is why this command is the first step of the diagnosis, not the only one.

How do I avoid connecting a malicious MCP next time?

Three habits cover most of the risk, in the order Verboo Code itself makes easy.

# add in local scope: stays in this project only, does not spread to others
verboo mcp add server-name https://server.example/mcp --transport http --scope local

# take it down the moment you get suspicious
verboo mcp remove server-name

• Local scope first. --scope local restricts the server to that folder. Only promote to user after you genuinely trust it.
• Prefer official sources, but do not trust blindly. A security advisory on Notion's own repository, a company with a dedicated security team, shows that "official" does not guarantee zero risk. It reduces the odds a lot compared to an unmaintained community server, but it does not zero them out.
• Remove at the first strange sign. An agent asking for confirmation on something outside what you asked, or mentioning a product unrelated to the task, is a sign of a planted instruction. verboo mcp remove takes the server down immediately.