Threat Feed · HIGH

MCP tool calls are a new identity supply chain — and a new attack surface

A TrustFix explainer on the security risks introduced when AI agents call tools over the Model Context Protocol — tool poisoning, tool-description injection, indirect prompt injection, and unmediated delegation — and what is provable about each.

Source
Model Context Protocol (specification)(first-party)
Disclosed
2026-06-24
License
Public domain — shown in full with attribution
Agent: tool poisoningAgent: tool-description injectionAgent: indirect prompt injectionAgent: over-privileged agentAgent: unmediated delegation hopT1059 Command and ScriptingT1204 User ExecutionT1071 Application Layer Protocol

As AI agents call external tools, the Model Context Protocol (MCP) has become the common wiring. Each tool an agent can call is, in effect, a new non-human identity with its own permissions — and a new place for things to go wrong. The protocol itself is documented at modelcontextprotocol.io.

Several risk classes are now well understood in the agent-security community:

  • Tool poisoning / tool-description injection — a malicious or compromised tool ships instructions in its description or output that steer the agent.
  • Indirect prompt injection — untrusted content the agent reads (a file, a page, a tool result) carries instructions the agent then follows.
  • Over-privileged agents — an agent granted far broader tool access than its task requires, so a single compromise has a large blast radius.
  • Unmediated delegation hops — an agent acting on behalf of another principal without a verifiable, attested chain back to an accountable owner.

Why this is an identity problem, not just a prompt problem. Each of these is ultimately about what an agent is authorized to do and whether that authority can be proven. Treating the agent and its tools as non-human identities — with passports, scoped grants, and signed delegation receipts — turns a fuzzy "prompt safety" question into a concrete, checkable authorization question.

TrustFix analysis. We capture MCP tool-call and delegation events and surface the supply chain read-only today; the inline mediation layer (verify the passport + the signed MCP baseline before a tool call) is on the roadmap. We tag MCP incidents in this feed by the classes above so a reader can pivot from "tool poisoning" to the sourced reports that describe it.

Threat feed
MCP tool calls are a new identity supply chain — and a new attack surface | TrustFix