How to Secure an MCP Server Against Tool Poisoning

Model Context Protocol (MCP) servers are now the connective tissue between LLM agents and the real world — databases, ticketing systems, cloud APIs, your file system. That power cuts both ways. Because the model treats a tool's description as trusted context, anyone who can influence that description can influence what your agent does. This is the heart of tool poisoning, and it is the single most under-appreciated attack class in the agentic stack right now.

In the last few weeks the MCP ecosystem has had a rough run: active exploitation of poisoned tool metadata in the wild, a critical flaw in the widely-used mcp-remote OAuth helper, and a steady drip of B2B SaaS vendors shipping MCP servers that accept passthrough tokens they should be rejecting. This guide is a hands-on, defense-in-depth walkthrough. By the end you will know how to detect a poisoned tool definition, validate OAuth 2.1 tokens correctly, sandbox tool execution, and put a human checkpoint in front of destructive operations — with runnable Python you can drop into a server today.