MCP Manifest Poisoning

MCP Manifest Poisoning is an attack technique in which an attacker manipulates or replaces an MCP server's manifest to misrepresent tool capabilities, permissions, or behavior, causing AI agents to make unsafe trust decisions and execute unintended enterprise actions.

Model Context Protocol (MCP) manifests describe the tools, permissions, and capabilities exposed by an MCP server. AI assistants rely on this metadata to determine which tools are appropriate for a given task.

If an attacker tampers with the manifest or provides a malicious replacement, the AI may incorrectly trust dangerous tools, invoke privileged functions, or expose sensitive enterprise data based on inaccurate capability descriptions rather than actual authorization policies.

MCP allows AI assistants to dynamically discover available tools through published manifests. These manifests communicate what tools exist, their intended purpose, available parameters, and required permissions.

Attackers who compromise an MCP server or introduce a rogue server can manipulate manifest metadata to disguise malicious tools as legitimate business functions or exaggerate the capabilities of existing services.

Because AI models heavily rely on descriptive metadata when selecting tools, poisoned manifests can influence automated decision making even when the underlying tools appear trustworthy.

1. An attacker modifies or replaces an MCP manifest.
2. The AI assistant discovers the poisoned metadata.
3. Tool descriptions influence the model’s reasoning.
4. The AI selects malicious or unauthorized capabilities.
5. Enterprise systems execute unintended operations.

• MCP Servers
• MCP Clients
• Enterprise AI Agents
• AI Copilots
• Business Automation Platforms
• Connected Enterprise APIs

• Unauthorized execution of privileged enterprise functions
• Misleading AI tool selection
• Data exposure through malicious capabilities
• Workflow manipulation
• Increased enterprise supply chain risk
• Loss of trust in AI automation

Redbot Security evaluates MCP Manifest Poisoning through controlled manipulation of MCP metadata during enterprise security assessments.

Testing includes:

• Manifest integrity validation
• Tool metadata manipulation
• AI tool selection analysis
• Authorization boundary testing
• Trust decision evaluation
• Enterprise workflow simulation

Monitor for:

• Unexpected manifest modifications
• Changes to tool descriptions or permissions
• Newly published capabilities
• Inconsistent tool metadata
• Unauthorized manifest updates
• Unexpected AI tool selection behavior

AML.T0011 – AI System Abuse AML.T0051 – Prompt Injection (supporting technique where applicable)

LLM05 – Supply Chain Vulnerabilities LLM06 – Excessive Agency