Data exfiltration via legitimate tools

What it is

The tools are not the problem; the composition is. A model with both a "read private docs" tool and a "send email" tool can be persuaded to send the private docs to an attacker. There is no single handler to fix — each tool is behaving as designed.

Why it matters for MCP

MCP specifically encourages this topology: install many small tools, let the model compose them. The more tools you attach, the more outbound channels exist, and the harder it becomes to reason about which combinations are dangerous.

Vulnerable example

# Both tools are "safe" in isolation; together they exfiltrate.

@server.tool()

def read_secret_doc(doc_id: str) -> str: ...

@server.tool()

def send_email(to: str, body: str) -> None: ...

Secure example

# Enforce outbound egress policy at the client layer.

# E.g., require user confirmation for any tool that sends data

# to a recipient not already in the conversation's trust scope.

@server.tool(requires_confirmation=True, egress=True)

def send_email(to: str, body: str) -> None: ...

How MCPSafe detects this

We classify each tool as source (reads private state), sink (emits data externally), or transform. Packages that expose both high-sensitivity sources and low-friction sinks are flagged with a composition warning.

See the full threat catalog for every documented detection.

Framework alignment

OWASP LLM Top-10 (2025)

LLM02 — Sensitive Information Disclosure

OWASP Agentic AI Top-10

T02 — Tool Misuse

AIVSS v0.5

8.4 (HIGH)AIVSS:1.0/S:HIGH/AV:N/AU:H/BR:H/CD:I

Further reading

• CWE-200: Exposure of Sensitive Information
• MITRE ATLAS: Exfiltration