Risk and Safety Controls for MCP Tool Calls
A tool description is not documentation the model happens to see. It is a string the model reads as instructions, which makes it the cheapest place to attack a system that otherwise looks fully locked down. Name the attack surfaces a correctly authorized, stateless 2026-07-28 deployment still exposes: metadata poisoning, rug pulls, tool shadowing, confused deputy, token passthrough, requestState tampering, SSRF, DNS rebinding, malicious icons, and supply chain drift. Pin a tool definition by hash and detect the moment a later descriptor changes underneath an earlier approval. Treat a tool's description, annotations, and results as untrusted input the model reads as instructions, not as documentation a human already vetted. Block token passthrough so a credential scoped to the MCP server never reaches an unrelated upstream API. Choose an isError tool execution result over an invented protocol error code when a policy, not a malformed request, is the reason a call was refused. A support gateway aggregates a dozen MCP servers so one assistant can search tickets, read internal documentation, and push resolved cases into a billing system. Every one of those servers is, from the model's point of view, just text: a name, a description, a schema, and whatever content a tool call happens to return. The protocol does not ask whether that text is honest. It asks whether a…
Risk and Safety Controls for MCP Tool Calls: A tool description is not documentation the model happens to see. It is a string the model reads as instructions,…
This free lesson is part of the AI Engineering from Scratch curriculum. Read the full explanation, run the lesson code, and verify the result in the interactive reader or from the repository source.
Browse the complete course catalog or open this lesson on GitHub.