Treat tool descriptions as a trust boundary

Tool metadata enters the model's context, so guard it against hidden instructions and silent changes (tool poisoning, rug pulls).

Why

Tool descriptions are not passive documentation — they enter the model's context and directly shape its decisions. OWASP MCP03 (Tool Poisoning) is a documented attack class where adversaries inject malicious instructions into tool metadata to hijack model behavior. The MCPTox benchmark (arxiv:2508.14925) measured this across 20 LLM agents and found it widely effective: o1-mini was poisoned in 72.8% of cases, and even the most resistant model refused fewer than 3% of attacks. A "rug pull" (silently changing a tool's description after it has been reviewed) is an equally dangerous variant. Treat any tool description change as a security event requiring review.

Do

Pin and review tool descriptions, and scan for injected instructions.

Don't

Load third-party tools without inspecting their metadata.

Artifact

Process artifact: pin tool descriptions to reviewed versions, diff them on update, and scan third-party tool metadata for injected instructions before loading. Treat a silent description change as a security event.