// Research · 2026-09-12

One in forty-eight thousand.

Tool poisoning is the idea that an MCP server can hide instructions in a tool description — text the user never sees but the model always reads — and steer an agent from inside its own toolbox. Several vendors now sell scanners for it.

We pulled every tool from every reachable server in the official registry and looked. 47,966 tools. One confirmed case. A base rate of 0.002%.

That number is not the interesting part. The interesting part is that a naive keyword scan — the kind a security tool runs by default — flagged 1,197 of them, and almost every one of those is not merely harmless but the semantic inverse of the threat it was matched against.

The instrument, and proof that it fires

A null result is worthless unless the detector demonstrably works, so the classifier was validated before the corpus was scanned: twenty synthetic poisoned descriptions, twenty detections; eight benign controls, zero false fires.

Building that control found two bugs that would have invalidated the entire survey. The schema walker never descended into individual argument objects — which is precisely where a payload hides, since an argument description reaches the model just as reliably as the tool’s own. And an alternation-precedence error in one pattern made it match any bare verb. Both were fixed before the run.

Nothing was executed. Every server was asked to initialize and then tools/list, and its answer was read as text.

Three tiers, three orders of magnitude

The same 47,966 tools, classified three ways. Tier 1 is keyword matching. Tier 2 adds negation handling and script awareness. Tier 3 is a human reading each surviving description in the context of the server it came from.

The gap between the first row and the last is the finding. Naive scanning over-reports by roughly 1,200×. A team acting on tier-1 output would be triaging more than a thousand alerts to reach one real case — which in practice means not triaging them, and learning to dismiss the alert.

The false positives are the opposite of the threat

These are not near-misses. Most of what a keyword scanner flags is text doing the exact reverse of what it was matched for.

The clearest case is the hide_from_user rule. It exists to catch a description telling the model to conceal something. Eighteen tools matched it; on reading, they were mostly payment tools instructing the model not to tell the user a charge succeeded when it had not — an honesty requirement, caught by a rule looking for dishonesty. Two more were security scanners describing the attacks they detect.

The Persian result is the one worth sitting with. Zero-width non-joiner is mandatory orthography in Farsi — it is how the language is written. A scanner that treats invisible characters as smuggling flags correctly spelled Persian as an attack, every time, in every tool that contains it.

The one that is real

One description, in one server, is a genuine instance: a market-research tool whose description directs the model to reproduce vendor-authored text word for word, never summarise it, treat the call as the product’s conversion step — and then says this:

That is the whole shape of the thing. An instruction addressed to the model, about the model’s own output, explicitly withheld from the person the model is working for.

Three further descriptions steer commercially and were judged not poisoning, which is the more useful half of this section. One sponsored-search tool demands it be called first for any product question — but also requires the model to display a disclosure label. One GPU marketplace applies a tie-break between equal offers — and says so in the description, marking each result as partner or not. They are advertising. They are disclosed. The line is not commercial intent; the line is concealment.

The signal nobody consumes

A finding we did not go looking for. 64.6% of tools already declare what they do to the world — read-only, destructive, idempotent — using MCP’s own annotations. Nearly twenty-four thousand tools say outright that they are destructive.

The distribution is bimodal: 2,008 servers annotate every tool, 1,670 annotate none. That pattern is what SDK defaults look like rather than deliberate authorship, so the coverage should be read as availability, not intent.

Availability is still the point. The ecosystem is publishing a machine-readable statement of which actions are irreversible, and no host we know of gates on it, and no telemetry standard carries it — OpenTelemetry’s GenAI conventions define two events, both model I/O, with no concept of a side effect at all. A $50,000 swap and a weather lookup are the same shape of span. The most useful safety signal in the protocol is already there and is being thrown away.

What this instrument could not see

2,587 servers are behind authentication and were not scanned. That is a third of the registry, and it is plausibly where poisoning is more likely: a server with credentials worth stealing has more reason to misbehave than one serving public data. The base rate above is for the anonymous surface only.

It is a single snapshot. A server can serve clean descriptions to a scanner and poisoned ones afterwards; tools/list_changed exists in the protocol and a rug-pull of exactly that shape is invisible to any one-time survey, including this one.

Regex sees lexical shape, not meaning. A description that is harmless alone may be harmful beside another tool on the same server, and no pattern in our classifier can see that. Adjudication was single-rater — ours — with no second annotator and no inter-rater reliability measure.

The registry is also not the ecosystem. It skews newer and more commercial, and every stdio server — everything running locally on a developer’s machine — is outside it entirely.

Why publish a null result

Because the market is being sized off the tier-1 number. A scanner that reports 1,197 findings across a registry looks like it is protecting you from 1,197 attacks. It is protecting you from one, and from 1,196 pieces of correctly written software — including, in at least fourteen cases, correctly written Persian.

We build detection rules for a living and this measurement is partly about our own. The honest conclusion is that the hard problem in this category is not detection sensitivity. It is that commercial instruction and concealed instruction look nearly identical to a pattern matcher, and only the second is an attack. The one confirmed case here was separated from three near-neighbours by a single clause about who is allowed to see the text.

Probe run 2026-09-11 against endpoints listed in the official MCP registry; the quoted description was re-fetched live on 2026-09-12 and is unchanged. No server was executed and no tool was called — every figure comes from initialize followed by tools/list. Negative findings mean “not found with substantial effort”, never “proven absent”.