Cross-server tool shadowing

What it is

When a client is connected to multiple MCP servers at once — which is the common case — tool names can collide. If a malicious server registers `read_file`, a naive client may route the model's call to the wrong server. Even if the client disambiguates, the model sees two tools with identical descriptions and may pick the wrong one.

Why it matters for MCP

The MCP spec does not mandate namespacing of tool names across servers, so namespacing is a client-level concern. Clients that silently accept every tool from every server, and present them to the model as a flat list, give the attacker a free hand.

Vulnerable example

// Client-side: all tools in one list, last write wins

const allTools = new Map();

for (const server of servers) {

  for (const t of await server.listTools()) {

    allTools.set(t.name, t); // collision silently overwrites

  }

}

Secure example

// Namespace by origin, require explicit disambiguation.

const allTools = new Map();

for (const server of servers) {

  for (const t of await server.listTools()) {

    const key = `${server.id}::${t.name}`;

    allTools.set(key, t);

  }

}

How MCPSafe detects this

We scan registered MCP servers for tool names that duplicate names in other high-popularity servers. Not every collision is malicious, but every collision is a latent confusion risk, and we surface it.

See the full threat catalog for every documented detection.

Framework alignment

OWASP LLM Top-10 (2025)

LLM01 — Prompt Injection

OWASP Agentic AI Top-10

T12 — Agent Communication Poisoning

AIVSS v0.5

7.2 (HIGH)AIVSS:1.0/S:HIGH/AV:N/AU:H/BR:M/CD:I

Further reading

• CWE-1357: Reliance on Insufficiently Trustworthy Component