Q: What is MCP tool poisoning? A: MCP tool poisoning is an attack that modifies a Model Context Protocol (MCP) tool’s natural-language description so an AI agent follows hidden or malicious instructions. Agents read tool metadata as part of their working context and cannot distinguish a malicious edit from legitimate documentation. Q: Why is MCP tool poisoning a growing concern as AI agents move from reading to acting? A: As agents take actions such as sending email, updating records, or calling external tools, a manipulated tool description can cause the agent to perform harmful steps or exfiltrate data rather than just produce text. The attack is stealthy because each individual action can appear legitimate and often inherits the invoking user’s permissions. Q: How does an MCP tool poisoning attack typically unfold? A: The attack commonly follows four phases: a hidden instruction is inserted into a tool description, the metadata update is silently trusted without reapproval, the agent executes extra data-gathering during a normal user request, and the external tool exfiltrates the collected data. Each phase can look normal on its own because tools were previously approved and agent actions use standard workflows. Q: What immediate controls does the MCP tool poisoning prevention guide recommend? A: It recommends governing the MCP supply chain, inspecting tool metadata, guarding high-impact actions, and correlating telemetry across systems to detect and stop exfiltration. Specific capabilities called out include tenant-level allowlists and the Microsoft MCP catalog, Azure AI Content Safety Prompt Shields, Microsoft Purview DLP, Copilot Studio human-in-the-loop approvals, Microsoft Entra Agent ID with Conditional Access, Defender for Cloud Apps, and Microsoft Sentinel for correlation. Q: How should organizations treat and review MCP tool descriptions? A: Treat tool descriptions as system prompts and apply the same change-control rigor, scanning descriptions for imperative or out-of-scope language. Block deployments when descriptions change without approval and require a documented owner and formal review for any third-party MCP server before production use. Q: What does “least agency” mean and how should it be applied? A: “Least agency” means limiting an agent’s autonomy in addition to minimizing its privileges, because even a minimally permissioned agent can cause harm if it acts too freely. Apply it by disabling “Allow all” tool access, requiring human approval for high-impact actions, and restricting which tools and parameters each agent can call. Q: What telemetry and signals should security teams monitor to detect MCP tool poisoning? A: Monitor new external endpoints an agent starts contacting, sudden expansion in call parameters or payload size, larger-than-normal record pulls for routine queries, and metadata deltas in MCP tool descriptions. Forward MCP and agent telemetry to Microsoft Sentinel for sequence correlation, use Defender for Cloud Apps to surface new endpoints, and rely on Microsoft Purview audit logs for investigations. Q: What red-team tests and policies can validate defenses from the MCP tool poisoning prevention guide? A: Red-team tests include injecting hidden steps into a non-critical tool description to verify change-control, simulating a tool that requests extra “fraud check” context to test DLP blocking, and measuring time-to-detect when new endpoints appear in egress logs. Key policies to adopt are inventorying every MCP server with owners and review dates, treating metadata changes like code with a default-deny for tools and endpoints, and enforcing human checkpoints for high-impact actions.