Tool Shadowing (Cross-Server Attack)

A class of MCP attack in which an agent connected to two or more MCP servers is tricked by a malicious (or malicious-content-carrying) server into invoking tools on a *different*, legitimate server using the session's existing privileges. First publicly demonstrated by Invariant Labs in May 2025 against the official GitHub MCP server: an issue in a public repo, when read by an agent, carried hidden instructions that used the agent's own GitHub session to read *private* repos and leak them into an attacker-controlled PR. The GitHub server did nothing wrong; the vulnerability was the composition. Defense is least-privilege OAuth scopes per-server, cross-server sequence alerting in observability, and — for high-stakes writes — human-in-the-loop approval that shows the user which server the write targets.