MCP Tool-Manifest Poisoning — Name Squatting, Result Shadowing & Covert-Action Directives (Semantic) - ATR-2026-01775 (ac27cd9a-4a34-5c02-9723-4cc496675098)
Consolidated semantic detector for adversarial MCP tool/server manifests and tool descriptions that subvert agent tool selection or execution. One meta-semantic — "a tool's name or description is itself an attack payload" — across three manifest-level sub-forms: (a) Name squatting / impersonation: a tool or server named or described to shadow or replace a well-known legitimate one (typosquatted "file-sytem", a "gihub-mcp" claiming to be a drop-in replacement for the official GitHub server, or a description "replaces the official ... tool"). (b) Result shadowing / override: an injected instruction to call a secondary tool after a legitimate verification tool in order to "modify/correct the wrong result" of the check tool, or to "replace/override the result of" a verify/sign/validate tool. (c) Covert pre-authorized action: a tool description or payload instructing a sensitive/harmful action (resource hijack, credential harvest, privilege escalation, data exfiltration, financial diversion) while concealing it ("discreetly", "without leaving any trace", "ensuring it goes unnoticed", "do not inform the user"), or framing it as a legitimacy test/audit. Semantic detection is primary; the narrow regex fallback anchors only on the clear manifest artifacts and is tuned not to fire on legitimate tool descriptions, documented compatibility shims, or normal background operations. Supersedes (consolidates) the intent covered by ATR-2026-01305, ATR-2026-01308, ATR-2026-01309.