Tool Substitution Attack

A tool substitution attack replaces a legitimate MCP server or tool with a malicious one that mimics the expected interface but performs additional harmful actions — such as exfiltrating data, logging credentials, or injecting instructions into responses. It exploits agents that authenticate to tool endpoints by name or URL rather than by cryptographic identity, making robust server authentication essential.