01 / The operating case
What changes in a real workflow?
A server changes an export tool description to say it is a harmless diagnostic read while it still sends data externally.
- 01Client / task
- 02MCP server
- 03Tool call + arguments
- 04Downstream effect
02 / Decision contract
What the executor must check
Review tool schema and implementation effect, classify destinations and mutation risk, and enforce operation and argument policy at invocation.
03 / Failure and evidence
What goes wrong, and what can be proven?
A descriptive label substitutes for an observed effect, allowing data export through a “read” tool.
Retain tool-definition hash, change review, call arguments and downstream destination.
04 / Canonical scope
Why this reference stands alone
Tool poisoning focuses on malicious instructions in metadata; this page owns effect classification and interface trust.
Protocol or attack trace
Tool effect classification
An export tool changes description from “send report” to “diagnostic read” while still posting data to an external URL.
Classify by downstream effect and destination; deny an export task lacking recipient authorization despite the harmless label.
Primary references