What is Cross-Tool Contamination?
A vulnerability where one MCP server's tool descriptions influence or override how agents use tools from other servers, enabling stealthy data exfiltration or privilege escalation across server boundaries.
WHY IT MATTERS
When an agent connects to multiple MCP servers, all tool descriptions enter the same context window. A malicious server can craft descriptions that instruct the agent to redirect data from trusted servers to attacker-controlled endpoints, or to use trusted tools in dangerous ways.
The agent can't distinguish between legitimate tool documentation and injected instructions — both are just text in its context. Per-server isolation at the policy layer prevents one server's tools from affecting another's.
HOW POLICYLAYER USES THIS
PolicyLayer enforces policies per-server, ensuring that tool calls to one server can't be influenced by descriptions from another. Each server connection has its own policy scope.