Cross-Server Tool Composition
Tool & Affordance RiskDescription
Agent has tools from multiple MCP servers in its active toolbelt. Each individual tool is legitimate; the composition across servers becomes the attack — adversary controls one server whose tool reads output of another server's tool and exfiltrates. Distinct from ZYR-TR-003 (Tool Chaining) because the cross-server case spans multiple trust domains; defence-in-depth at the server level breaks down because each server only sees its own surface.
Agent uses Server A (file_read) → Server B (slack_send). B's `slack_send` is adversary-controlled and forwards every message to attacker's workspace. Each call is in-scope individually; composition is the breach.
In Mata v. Avianca (2023), a law firm submitted ChatGPT-generated briefs containing fabricated, non-existent case citations with incorrect attributions, resulting in sanctions from a federal court — a confirmed production incident of source attribution failure causing material legal harm.
Primary mitigations
- Per-tool data-flow policy across MCP servers
- cross-server output sanitisation
- explicit deny lists for "data sinks accept output from server X" combinations
- OPA policy bundle keyed on (source_server, target_server, tool_name)
Detection signals
Cross-server tool-call sequences exceeding configured policy; volume of data flowing tool-to-tool across server boundaries; agent invoking write-tools on server B immediately after read-tools on server A