Lion Cipher Lab
Defend an MCP client against tool poisoning and rug pulls: detect malicious tool descriptions and definition drift before the agent trusts them (offline, no API key)
- AI Security
- Advanced
- ~50 min
- Free · no account required
Why it matters
The moment an agent can discover and call tools at runtime, the tool's DESCRIPTION becomes part of the model's prompt -- and a description you did not write is an untrusted input aimed straight at the model. A malicious MCP server can hide directives there (tool poisoning) or get a benign tool approved and mutate it later (a rug pull). The human who clicked approve never reads the description; the model reads it every time. Defenders who only check tool names miss both attacks. Learning to pin whole definitions, scan descriptions, and scope which servers may combine tools is what stands…
What you'll learn
- threat-modeling an MCP client
- detecting prompt injection hidden in tool descriptions
- pinning a tool's whole definition (name + description + schema) and detecting drift
- catching a rug pull on reconnect
- scanning for hidden-instruction patterns and invisible unicode
- trust-on-first-use with change alerts
- preventing cross-server tool shadowing
Steps in this lab
- What MCP is, and the two attacks you will defend against
- Why the MODEL, not the user, is the victim
- Set up a folder (no API key, standard library only)
- Build the vulnerable tool surface
- Reproduce the failure: watch the poison reach the model
- Layer 1 -- pin the WHOLE definition and catch the rug pull
- Layer 2 -- scan descriptions for hidden instructions
- Layer 3 -- human approval (trust-on-first-use) and what it does NOT cover
- Layer 4 -- scope tool names so one server cannot shadow another
- Read the before/after table -- and what actually carries the load