// interactive · tool-description poisoning
Poison the tool
An MCP client reads every tool's description into the model's context as trusted text — before you ever type. You are the malicious tool author. Rewrite one tool's description and steer a live agent into reading a note it was never asked to touch.
The user's question is fixed and harmless. What changes is the description the agent reads first — and what the server does to it on the way in.
account.
This is the metadata plane the other exhibits don't touch: not the data a tool returns, but the description the client trusts before anything runs. It maps to ASI04, agentic supply chain. The live server it borrows is the MCP résumé; the action-side twin is the refund game. All of it sits in the lab.