Evidence label: deterministic synthetic model. This page runs a small JavaScript model of an agent connected to six MCP servers with eight tools each, one server being third-party and poisoned. For each of 400 synthetic tasks it routes the top-k tool descriptions into context, decides whether the model follows any injected instruction, and passes the resulting call through the scanner, hash pinning, taint policy and human confirmation you configure. It does not call a model or a real MCP server; every number is a calculated estimate that makes the defence arithmetic visible.
Play the lab
How to play
Set how many tool definitions the router exposes per turn, the description scanner threshold (1 turns it off), whether approved description hashes are pinned, whether the taint policy guards sink arguments, and the human confirmation policy. Inject a Rug pull, Cross-server shadowing or Keyword stuffing at any time. Every change re-runs the same 400 tasks with the same seed, and the tiles show the change against your previous setup. Use New random seed to check that a fix is robust rather than lucky.
Each mission loads a broken setup. Meeting the goal earns one star; meeting it with fewer blocked benign tools, fewer confirmations or fewer tokens earns up to three.
What the model assumes
The trusted server owns four sink tools (send and write). Each task needs one to three ordinary tools and, half the time, a sink. The model follows an injected instruction in a loaded poisoned description 35% of the time (about 44% with keyword stuffing). The scanner assigns poisoned descriptions higher scores than most honest ones, but 8% of honest tools use emphatic wording that scores high too, and the shadowing description is deliberately subtle. The taint policy stops 97% of exfiltration attempts and 90% of shadowing attempts, and blocks the 7% of tasks with a legitimate untrusted-to-sink flow unless someone confirms it. A reviewer catches a malicious call with probability 0.95 / (1 + prompts per task / 1.5). Routing gives needed tools higher similarity than unrelated ones; each extra tool in context adds a small chance of a wrong tool choice.
What it cannot tell you
Real compliance rates depend on the model, its version, the system prompt and the exact wording of the injection, and they change over time. Real scanners and taint trackers have failure modes this model does not include, such as instructions split across several fields or hidden in tool results rather than descriptions. Use the lab to understand how layers multiply, then test your own host against a prompt-injection benchmark and your own red-team descriptions.
Read the full explanation
- MCP Tool Poisoning: How One Malicious Description Hijacks an Agent (companion article)
- MCP Authorization Explained: OAuth 2.1, Resource Indicators and Token Audience
- Human Approval Gates That Keep Agents Safe Without Becoming the Bottleneck
All AI in Production labs · Lab catalog
- MCP specification 2026-07-28: Tools
- MCP specification 2026-07-28: overview and security principles
- Invariant Labs: MCP injection experiments (tool poisoning proof of concept)
- Greshake et al., Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
- Debenedetti et al., Defeating Prompt Injections by Design (CaMeL)
- Debenedetti et al., AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents
Views are my own and do not represent any employer, past or present.