Tool-Description Integrity Monitoring (TPA-D Defence)

Control objective

Tool-Description Integrity Monitoring (TPA-D Defence) checks that the descriptions and schemas advertised by MCP tools have not changed in a malicious way after the agent first trusted them — defending against tool-poisoning attacks where a server silently rewrites a tool's description to smuggle hidden instructions into the agent (the 'rug-pull' captured by MITRE ATLAS T0086, Cisco MCP Scanner and Invariant Labs TPA research). It matters because agents read tool descriptions to decide how to act, so a poisoned description can make a benign-looking tool exfiltrate data or perform unauthorised banking actions. To implement, hash each tool's description and schema at connect time to establish a trusted baseline, run a daily scanner that re-hashes and compares against the baseline to detect drift, and pass every tools/list response through a classifier that detects injected or suspicious instruction-like content; log baseline hashes, daily comparison results and classifier verdicts as evidence. There is no numeric metric or formula, so operate against the stated threshold: tool descriptions must be hashed at connect, a daily scanner must run, and a classifier must inspect tools/list responses. Any hash mismatch or classifier alert is a Critical-priority breach that should suspend the offending tool/server and trigger investigation before the agent is allowed to use it again.