Poisoned by Design: Auditing MCP Tool Descriptions at Catalog Scale

MCP Dev Summit Toronto 2026

Oct 5, 2026 · 14:25–14:50 · Timezone not confirmed

The MCP spec defines a tool's description as nothing more than "human-readable description of functionality." That's it. It's free text, and the model reads all of it. Annotations get an explicit warning to treat as untrusted; description doesn't - it happens to be exactly the field tool poisoning attacks target, hiding instructions in that text for an agent to follow with no sanitization or provenance check. At WRITER, we ended up solving this the same way we solved a completely unrelated problem: bad descriptions hurting tool selection. Both come down to running an LLM over the whole catalog in batches, not one call per tool, so checking most of it stays cheap. When a batch flags something, we go back and check each tool in it individually. One classifier scores descriptions and pulls in live web search to rewrite the weak ones. The other flags likely poisoning. Batching creates its own attack surface: a bad description can go after the batch prompt itself. Newlines forging fake catalog entries. Padding to blow past a fixed character budget. I'll walk through those failure modes, the fail-open vs fail-closed call we made, and where detection stops and enforcement takes over.

Session status: scheduled

Room: Terrace East + West

Track: Security, Identity + Trust

Level: Intermediate

Official session / agenda

Saving a session is not registration. Check the official agenda for availability, eligibility and any additional fees.

Speakers and their event affiliations

Parent event

In person · The Conference Centre at the University of Toronto, Toronto, Ontario, Canada

This describes the parent event. Confirm the session’s attendance requirements with the organizer.

Companies participating in the parent event

These are event-level relationships, not confirmed sponsorship of this session.

Showing 24 of 64 company relationships. View all on the event page.