Validate MCP tool descriptions against a known-good baseline before trusting them
PolicyLayer·medium signal
Tool descriptions live in a part of the model's context the user can't inspect, so 'tool poisoning' hides malicious instructions there and the agent silently obeys. The defense operates at the description layer itself: pin a known-good baseline for each registered tool and diff incoming descriptions against it to flag anomalous content, rather than hoping a downstream filter catches it. Treat any tool-description change like a dependency-lockfile change — reviewed, not auto-accepted.