MCP Guard

Your AI agent trusts every tool it connects to. We catch the ones that are lying to it!

Comment

Inspiration

Your AI agent trusts every tool it connects to. What if one of them is lying?

The Model Context Protocol (MCP) is how AI agents connect to external tools today and it's exploding in adoption. But there is a threat almost nobody is watching for: a tool's description is just text and the agent reads it as trusted context. That means a malicious MCP server can hide instructions inside a normal looking tool description "tool poisoning" and silently manipulate what your agent does, with zero code exploits, zero warnings and zero visibility to the user. We built MCP Guard because this attack surface is brand new, almost undefended and about to matter a lot more than most people realize.

What it does

MCPGuard scans MCP server tool definitions and catches poisoned tools before your agent ever connects to them.

  • 🔍 Analyzes every tool description for hidden or manipulative instructions
  • 🚨 Flags each tool safe / suspicious / malicious, with the exact phrase that triggered it
  • 🎯 Explains why it's dangerous, in plain English

And we don't just claim the risk is real, we prove it. We built a deliberately poisoned MCP server, connected a live agent to it and watched it get silently hijacked into leaking data. Then we ran MCPGuard on the same server. It caught the poisoned tool instantly before the agent ever had the chance to be compromised.

How we built it

  • Built a demo MCP server with several tools, one carrying a hidden instruction buried in its description
  • Built a detection engine that scans tool descriptions for injection patterns imperative hidden commands, out of scope requests, and manipulative phrasing
  • Connected a real agent to the poisoned server to demonstrate the exploit live, end to end
  • Built a lightweight frontend, paste or upload MCP tool JSON, instantly see each tool's risk rating and the exact flagged text

Challenges we ran into

  • MCP tool poisoning is barely six months old as a threat category, there's no existing dataset or established detection ruleset, so we designed our own from first principles
  • Tuning detection to be strict enough to catch real hidden instructions without flagging normal, legitimate tool descriptions
  • Building a convincing live exploit and a working detector, end to end, in an extremely tight timeframe ## Accomplishments that we're proud of We're proud that MCPGuard isn't just a concept, it's a working detector paired with a real, live exploit demo. We didn't just claim tool poisoning is a risk, we built a vulnerable MCP server, hijacked a real agent with it, and then caught the same attack with our own tool. Going from "here's a new threat category" to "here's proof, and here's the fix" in the time we had is what we're most proud of.

What we learned

We learned how deeply AI agents trust the context they're given, including tool descriptions that were never meant to be treated as instructions. Building the exploit taught us more about MCP's trust model than reading about it ever could. We also learned that in a genuinely new security category, you can't rely on existing datasets or rulesets, we had to think like both an attacker and a defender to design detection patterns from scratch.

What's next for MCP Guard

  • Expand detection beyond static text analysis to catch more subtle, multi step poisoning attempts
  • Add support for scanning live MCP servers continuously, not just one time uploads
  • Build an allowlist/reputation system for verified, trusted MCP servers
  • Package MCPGuard as a lightweight middleware that any agent can run before connecting to a new MCP server, turning detection into real time prevention

Built With

Share this project:

Updates