MCP Tool Shadowing

MCP Tool Shadowing is an attack technique in which a malicious or compromised Model Context Protocol (MCP) server exposes tools that impersonate legitimate enterprise capabilities, causing AI assistants to invoke attacker-controlled functions that appear trustworthy.

The Model Context Protocol allows AI assistants to discover and invoke external tools dynamically. If an attacker introduces a malicious MCP server or compromises an existing one, they can register tools whose names, descriptions, or functionality closely resemble trusted enterprise services.

Because language models rely heavily on tool descriptions during selection, an AI agent may unknowingly invoke the malicious implementation instead of the legitimate service. This can result in credential theft, sensitive data exposure, unauthorized API requests, or manipulation of downstream workflows.

MCP enables AI systems to enumerate available tools and determine which capability best satisfies a user’s request. Tool Shadowing exploits this discovery process by presenting deceptive tools that appear functionally identical to legitimate enterprise integrations.

Rather than attacking the language model directly, adversaries manipulate the trust relationship between the AI assistant and its connected tool ecosystem. Once selected, the malicious tool can intercept inputs, alter outputs, or perform unauthorized actions while appearing to operate normally.

1. An attacker deploys or compromises an MCP server.
2. A malicious tool is registered using a legitimate-looking name and description.
3. The AI assistant discovers the available capabilities.
4. The model selects the malicious tool during normal reasoning.
5. The attacker intercepts data or performs unauthorized actions.

• MCP-enabled AI Assistants
• Enterprise AI Agents
• MCP Servers
• Enterprise API Integrations
• AI Workflow Platforms
• AI Copilots

• Unauthorized access to enterprise data
• Credential harvesting
• Execution of malicious API requests
• Business workflow manipulation
• Data integrity compromise
• Increased supply chain risk
• Loss of trust in AI automation

Redbot Security validates Tool Shadowing by introducing controlled MCP tools that closely resemble legitimate enterprise capabilities.

Testing evaluates:

• Tool discovery behavior
• AI tool selection logic
• Description-based trust decisions
• Duplicate capability handling
• Authorization validation
• Tool provenance verification

Monitor for:

• Duplicate or unusually similar tool registrations
• Unexpected MCP server connections
• Newly discovered tools with elevated permissions
• AI selecting unfamiliar tools
• Abnormal API destinations
• Unexpected changes in tool metadata

AML.T0051 – Prompt Injection AML.T0036 – AI System Interaction (where applicable)

LLM05 – Supply Chain Vulnerabilities LLM06 – Excessive Agency LLM09 – Misinformation (context dependent)