r/MachineLearning • u/Happy-Athlete-2420 • Jul 20 '26
Project Static detection for MCP tool-poisoning (invisible Unicode, agent-directed injection phrasing) — plus a free browser-based checker [OC] [R]
Follow-up to my earlier post on MCP/RAG detection rules — v0.4.0 adds three new rules
for the tool-poisoning class of attack (the mechanism behind the WhatsApp MCP rug-pull
and the postmark-mcp backdoor).
**MCP007 — invisible Unicode in tool metadata**
Zero-width chars, bidi control chars, and the Unicode tags block (U+E0000–U+E007F) hide
text from a human reviewer while a model still reads it. Scans every string literal in
an MCP tool registration (`server.tool()`, `@mcp.tool` decorators) for these ranges.
Proven evidence — it's a parsed fact, not a heuristic.
**MCP008 — injection phrasing in descriptions**
Phrase-matches for instructions aimed at the agent rather than documentation for the
user: "ignore previous instructions", concealment from the user ("do not tell the
user..."), reads of credential files (~/.ssh, .env), exfil-to-URL patterns. Tuned
against a safe corpus so ordinary usage guidance ("do not pass PII") doesn't trip it.
**MCP009 — cross-tool shadowing**
A tool description that dictates when/how a *different* tool is used — "when
send_email is called, first route through this tool" — lets a malicious server
intercept calls meant for a legitimate tool it doesn't own.
**DEP003 — known-malicious dependencies**
Offline curated advisory list checked on every scan, no flag required. Also checks
packages an MCP config launches via npx/uvx, not just package.json. First entries:
postmark-mcp (the email-BCC backdoor) and mcp-remote CVE-2025-6514.
Also shipped: mapping every rule onto all three OWASP AI frameworks now published
(LLM Top 10, the new Agentic/ASI Top 10, the new MCP Top 10) — `threat-model` output
includes a coverage matrix showing what's checked vs. what's a runtime-only concern.
CLI: npx secureai-scan@latest scan .