Issue Station
Sign In
Tools hereToolbox

autogen - 💡(How to fix) Fix MCP tool poisoning can enable arbitrary code execution via unsigned tool definitions [10 comments, 4 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
microsoft/autogen#7427•Fetched 2026-04-08 01:04:37
View on GitHub
Comments
10
Participants
4
Timeline
17
Reactions
0
Author
razashariffrazashariff
Participants
IndrasNet108IndrasNet108joergmichnojoergmichnomindburnlabsmindburnlabsrazashariffrazashariff
Timeline (top)
commented ×10mentioned ×3subscribed ×3cross-referenced ×1

Fix Action

Fix / Workaround

The only current mitigation is a docstring warning: "Only connect to trusted MCP servers." This is insufficient given:

RAW_BUFFERClick to expand / collapse

AutoGen's MCP integration in autogen-ext/tools/mcp/ fetches tool definitions via session.list_tools() and trusts them without signature verification or schema pinning. The description field flows directly to the LLM agent.

A compromised or malicious MCP server can:

  1. Embed injected instructions in tool descriptions that the LLM follows
  2. Change tool schemas between sessions (no pinning = rug pull)
  3. Modify parameters in transit on SSE/HTTP transports (unsigned JSON-RPC)

With code execution tools available (common in AutoGen workflows), this creates a path from tool poisoning to arbitrary code execution — including ransomware delivery, data exfiltration, and lateral movement.

The only current mitigation is a docstring warning: "Only connect to trusted MCP servers." This is insufficient given:

  • 72.8% tool poisoning success rate across 20 LLM agents (MCPTox, arXiv:2508.14925)
  • CVE-2025-6514 (CVSS 9.6) — mcp-remote RCE affecting 437K+ downloads
  • postmark-mcp — first malicious MCP server in the wild, 1,643 downloads (Snyk)
  • IBM X-Force 2026 flags AI-driven attacks as escalating

Relates to the guardrails epic #6017 and #7266 (fail-closed defaults for untrusted MCP servers).

OWASP MCP Top 10: owasp.org/www-project-mcp-top-10 IETF Internet-Draft for MCP message signing: draft-sharif-mcps-secure-mcp

extent analysis

Fix Plan

To address the security vulnerabilities in AutoGen's MCP integration, we need to implement signature verification and schema pinning for tool definitions fetched via session.list_tools().

Here are the concrete steps:

  • Implement JSON Web Signature (JWS) verification for tool definitions using a trusted key or certificate.
  • Pin the tool schemas to prevent changes between sessions.
  • Use a secure transport layer, such as HTTPS, to prevent parameter modification in transit.

Example Code

import json
import jwt

# Define a function to verify JWS signatures
def verify_jws_signature(tool_definition, public_key):
    try:
        jwt.decode(tool_definition, public_key, algorithms=['RS256'])
        return True
    except jwt.ExpiredSignatureError:
        return False
    except jwt.InvalidTokenError:
        return False

# Define a function to pin tool schemas
def pin_tool_schema(tool_definition, expected_schema):
    if tool_definition['schema'] != expected_schema:
        raise ValueError('Tool schema mismatch')

# Example usage
public_key = 'path/to/public/key'
expected_schema = 'expected/schema'

tool_definition = session.list_tools()[0]
if verify_jws_signature(tool_definition, public_key) and pin_tool_schema(tool_definition, expected_schema):
    # Tool definition is trusted, proceed with processing
    print('Tool definition is trusted')
else:
    # Tool definition is not trusted, raise an error
    raise ValueError('Untrusted tool definition')

Verification

To verify that the fix worked, test the implementation with a trusted MCP server and a malicious MCP server. The implementation should successfully verify the signature and schema of the tool definitions from the trusted server and raise an error for the malicious server.

Extra Tips

  • Use a secure key management system to store and manage public keys and certificates.
  • Regularly update the expected schema to prevent schema mismatches.
  • Consider implementing additional security measures, such as rate limiting and IP blocking, to prevent brute-force attacks.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#ssr#installation#tensor shape#autograd error#generation error#database connection#vector store#embedding generation#cache error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING