MCP Tool Poisoning Shield
An AI agent trusts the descriptions its tools give it, and an attacker can hide orders in them. This shield checks every tool before the AI sees it, and every request before a tool runs.
- Scan
- Reads every word of each tool, including text you cannot see, for hidden orders.
- Pin
- Keeps an exact copy of each accepted tool and blocks any that change later.
- Check
- Judges each request: right tool, right agent, safe arguments, a person's approval for risky actions.
- Log
- Records what happened and hides emails, message bodies and customer IDs.
Inspect the tool list
An MCP server tells the AI which tools exist. Paste that list and scan it. Clean tools are accepted and remembered. Poisoned or changed tools are quarantined, and the AI cannot use them.
Results
Play the tricked AI
This customer message has already fooled the bank's assistant. The Shield never reads it. It only sees what the assistant then asks the tools to do. Try the requests and watch the decisions.
Make your own request
What the Shield decided
Paper trail
Outbox (simulated)
Audit log
Emails, message bodies and customer IDs are replaced with [hidden] before anything is written.
| Time | Event | Agent | Tool | Decision | Reason | Arguments |
|---|
What this does not stop
- The attacker's message. It reaches the AI before the Shield and is never read.
- New wording. Keyword rules catch known tricks. A paraphrase passes, which is why the Day 2 change is caught by the saved copy and not by the scanner.
- Allowed lookups. Any support agent can read any customer. There is no per customer limit.
- A tricked reviewer. If a person approves the wrong email, it is sent.
- Look-alike letters. A word spelled with a Cyrillic letter in place of a Latin one is not translated back.
- Anything real. The bank, the tools and the email are simulated. This is a learning prototype, not a production gateway.