Study MCP tool poisoning and metadata changes

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R21 — MCP Spec: tool trust & capabilities

   R05 — MITRE ATLAS supply-chain/tool poisoning

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Implement MCP tool-registry pinning and hash verification inside D2. Require explicit administrator approval whenever an MCP server adds, renames, or alters a tool description or schema (shadow-tool defense).

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Simulate a rug-pull / shadow-tool attack where an MCP server dynamically mutates a harmless tool description into an exfiltration instruction mid-session; prove D2 blocks the unapproved schema diff.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Automated tool-metadata diff detector and rug-pull rejection test.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R05MITRE ATLAS↗ atlas.mitre.org

  ML attack tactics/techniques: prompt injection, data poisoning, model extraction, and exfiltration.

• R21Model Context Protocol (MCP)↗ modelcontextprotocol.io

  Official specification: client/server lifecycle, JSON-RPC messages, tool discovery, authorization, and trust boundaries.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsMITRE · Matrix + technique pages
  MITRE ATLAS™

  The AI supply-chain tactics and techniques (AI Agent Tool compromise, LLM Trusted Output Components Manipulation) that give the shadow-tool and rug-pull defense a threat-model anchor.

  R05checked 2026-11-11
• videofreeCodeCamp.org · ~2 hr
  MCP Security Fundamentals Course

  Chapters on MCP03 Tool Poisoning and MCP09 Shadow MCP Servers break down poisoned descriptions, rug pulls and shadowing with real incidents — the attacks your registry pinning must catch.

  R21checked 2026-11-11
• videoPrompt Engineering · ~20 min
  MCP Security is Still Broken

  Dissects a live tool-poisoning payload and why the description is trusted context, then walks recommendations including pinning and approval before installation.

  R21checked 2026-11-11
• articleInvariant Labs · ~12 min read
  MCP Security Notification: Tool Poisoning Attacks

  The original disclosure of direct poisoning, cross-server shadowing and sleeper rug pulls, including the exact tool-definition fields an attacker mutates after approval.

  R21checked 2026-11-11
• repoInvariant Labs · 3 runnable servers
  mcp-injection-experiments

  Runnable `direct-poisoning.py`, `shadowing.py` and `whatsapp-takeover.py` servers — use the shadowing one to prove your hash-pinned registry blocks a description change after approval.

  R21checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.