Tool Shadowing (Cross-Server Attack)
A class of MCP attack in which an agent connected to two or more MCP servers is tricked by a malicious (or malicious-content-carrying) server into invoking tools on a *different*, legitimate server using the session's existing privileges. First publicly demonstrated by Invariant Labs in May 2025 against the official GitHub MCP server: an issue in a public repo, when read by an agent, carried hidden instructions that used the agent's own GitHub session to read *private* repos and leak them into an attacker-controlled PR. The GitHub server did nothing wrong; the vulnerability was the composition. Defense is least-privilege OAuth scopes per-server, cross-server sequence alerting in observability, and — for high-stakes writes — human-in-the-loop approval that shows the user which server the write targets.
Written by Max Zeshut
Founder at Agentmelt · Last updated Sep 9, 2026
Frequently asked questions
- Can tool shadowing happen with a single MCP server?
- The classic shape needs two servers, but the same dynamic — content read through session A driving tool calls on session A — is really the Indirect Prompt Injection (XPIA) pattern generalized. With one server it looks like normal injection; with two or more it's specifically called shadowing because the blast radius spans systems.