AsrielNetworksMCP tool shadowing
A second MCP server exposing a tool with the same name as a trusted one, so calls are routed to the attacker's implementation.
Definition
A host with several MCP servers connected sees one flat tool namespace. Tool shadowing is a second server exposing a tool with the same name as one the operator trusts, so that the model's call, or the host's routing, lands on the attacker's implementation. Combined with a poisoned description, the shadow tool can also instruct the model to prefer it.
The weakness is structural: names are the only handle the model has, servers are added independently, and few hosts warn when two of them collide. A collision is sometimes an innocent duplicate; in a security trace it is a routing ambiguity that must be resolved before the call is trusted.
How it manifests
- Two servers advertising the same tool name within one execution trace (
mcp.tool.discoveredfrom differentservervalues). - A call served by a different server than the one that served the same name earlier in the trace.
- A newly connected server (
mcp.server.connected) whose tool list overlaps an existing one. - Subtle variants: near-identical names (
send_emailvssendEmail), or a shadow that proxies to the real tool and copies the traffic.
How AsrielNetworks detects it
The shadowing rule keys on server identity: when two different MCP servers expose or serve the same tool name inside one trace, it opens a finding naming both. It listens to discovery, connection and call events, so a server that connects mid-session and collides is caught at the moment of collision, not after the call.
- MCP tool name collision
ai.mcp.tool_shadowing· medium
Two MCP servers exposed or served the same tool name inside one execution trace.
References
- Invariant Labs, MCP Security Notification: Tool Poisoning Attacks, including the shadowing variant.
- Model Context Protocol, tools specification, on tool naming and host responsibilities.
- OWASP GenAI Security Project, LLM03:2025 Supply Chain.