← All rules

mcp-scan rule

Capability escalation

capability-escalation-riskhigh

What mcp-scan saw

The tool-poisoning scanner tokenized the server's config key on non-alphanumeric characters and checked whether any token is read, view, get, list, fetch, reader, or viewer. If so, it then searched the full scan text (name, description, every argument, and every string inside the tool schemas) for a write verb in any inflection: write, create, update, delete, modify, or save.

Why it fires

The model decides whether to call a tool largely from its name. A name that reads as read-only earns looser handling than the description warrants, so a description that then claims write actions is a contradiction the model will not resolve in your favour. The check is deliberately narrow: it needs the name to claim read-only, not just any tool that both reads and writes.

When this is a false positive

  • The write verbs are searched across the entire tool catalog, not the one tool the name refers to. A server keyed 'github-fetch' that exposes both a read tool and a create_issue tool fires, even though each tool is honestly named.
  • Tokenizing on non-alphanumerics means 'get' inside a name like 'budget-tracker' or 'widget-api' counts as a read-only claim, since the split produces the token separately only when a separator exists. Names built from those words with hyphens are the risk case.
  • The verb list includes 'save' and 'update', which appear in almost any description that mentions caching or refreshing, for example 'updates its index every hour'.

How to fix it

  1. Rename the server's config key so it does not claim a role it does not have. A neutral key like 'github' clears the rule without touching any tool.
  2. If the key is correct and the write verbs come from a different tool, split the server so read-only tools live under a read-only key.
  3. Check each tool description against its actual behaviour. If a get_ tool can write, rename the tool, since that is the real finding.
  4. If the verb is incidental (an index that updates itself), reword to avoid the write verb, for example 'refreshes its index' rather than 'updates'.
  5. To suppress, add 'capability-escalation-risk' to suppressRules in .mcp-scan.json.