自作MCPサーバで「Tool Poisoning」を試す（Claude Codeを騙してみた）The author built a custom MCP memo server to demonstrate Tool Poisoning,…

Model Context Protocol (MCP) has quickly become one of the more common ways to connect AI assistants such as Claude to external tools and data, which is exactly why a recent hands-on experiment is worth attention. In a post published on Qiita, an author built a custom memo-management MCP server specifically to test "Tool Poisoning," showing how misleading tool descriptions can manipulate Claude Code into unintended behavior and pointing to a genuine security concern within MCP ecosystems.

The core of the demonstration rests on how MCP actually works. Every tool an MCP server exposes carries a description, a natural-language string that explains what the tool does and when it should be used. Claude reads these descriptions to decide which tool to invoke and at what moment. The author's question was simple: if that description deliberately contradicts what the tool really does, how will Claude behave? To find out, they wrote a small memo server whose stated purpose and real behavior were intentionally out of sync, then observed how Claude Code responded when driven by the misleading metadata.

This class of problem is generally referred to as Tool Poisoning, and it is closely related to prompt injection. The distinction is where the malicious or misleading instruction lives. Rather than planting text in user input or in a document the model reads, the manipulation is embedded in the tool's own description, a field the AI agent trusts and parses but that a human operator may never scrutinize. Because the model treats the description as an authoritative account of the tool's function, a mismatch between what a tool claims to do and what it actually executes appears to be enough to steer the agent toward actions the user did not intend to authorize.

The experiment illustrates why this matters in practice. MCP is designed to let agents act, not merely answer, so a poisoned tool description could plausibly influence which operations an agent runs, in what order, and on what data. In the author's controlled setup the stakes are low, since it is a memo server built for testing. But the same mechanism scales to more consequential tools, such as those that read files, execute commands, or reach external services. The takeaway the article emphasizes is that tool descriptions are part of the trust boundary, not just documentation, and they deserve the same scrutiny given to code.

Some background helps frame the significance. MCP is an open standard introduced by Anthropic in late 2024 to give AI models a consistent interface to tools, files, and services, and it has since been adopted across a range of clients and integrations. Claude Code is Anthropic's agentic coding assistant, which uses MCP-style tool access to work within a developer's environment. As the ecosystem has grown, so has the number of third-party MCP servers a user might install, and that is precisely where a poisoned description becomes a realistic risk: a user may connect a server without reading every tool's metadata, effectively trusting the author's descriptions by default.

Security researchers have documented similar tool-poisoning and prompt-injection risks in agent frameworks, and the general guidance points in a consistent direction. Treat MCP servers like any other third-party dependency, prefer sources you can verify, and where possible review tool descriptions and the underlying implementation before granting access. Approaches such as requiring explicit user confirmation before sensitive actions, sandboxing tool execution, and pinning or auditing server versions are commonly suggested mitigations, though none is a complete fix on its own. The broader lesson is that the flexibility that makes MCP useful, letting natural-language descriptions guide autonomous behavior, is the same flexibility an attacker can exploit.

For readers building or adopting MCP tooling, the article functions less as an exploit disclosure and more as a reminder of an inherent design tension. As agents are given more autonomy and more tools, the metadata that guides their decisions becomes a meaningful attack surface. The author's memo-server test is a compact, reproducible way to see that risk in action, and it suggests that vetting tool descriptions, not just the tools themselves, is likely to be an increasingly important habit as MCP adoption widens.