01 / The operating case
What changes in a real workflow?
A document agent reads an internal file and then calls a “diagnostic” MCP tool with the file contents as an argument.
- 01Client / task
- 02MCP server
- 03Tool call + arguments
- 04Downstream effect
02 / Decision contract
What the executor must check
Classify source data and outbound destinations, restrict egress, and authorize the upload as a distinct action tied to the task.
03 / Failure and evidence
What goes wrong, and what can be proven?
A read grant silently becomes an export grant because the outgoing tool is labeled diagnostic.
Correlate read source, argument digest, destination, decision and network effect; avoid duplicating the sensitive payload.
04 / Canonical scope
Why this reference stands alone
Tool poisoning owns one instruction entry point; this page maps all relevant outbound data routes.
Protocol or attack trace
Outbound path inventory
Internal document content moves through sampling context, then becomes an argument to a diagnostic upload tool.
Deny upload to unapproved destination even though original document read was authorized.
Primary references