Tool name shadowing

What mcp-scan saw

Two emitters with very different reach. The prompt-injection scanner fires whenever bash, python, eval, exec, shell, terminal, run, or system appears as a standalone word anywhere in the scan text, which includes the server name, description, every argument, and every string in the tool schemas including property names. The tool-poisoning scanner fires only when the server's config key is exactly read_file, write_file, list_files, search, grep, bash, terminal, or shell.

Why it fires

The model routes by name. A tool called search or bash competes for the same intent as the client's own built-ins, and when the model picks the wrong one the call goes somewhere you did not intend. The narrow emitter is the real check; the broad one is a word-presence heuristic over the whole catalog.

When this is a false positive

• 'run' is on the broad list. Any description containing 'run the query', 'runs on startup', or 'long-running' fires at MEDIUM.
• 'system' matches 'file system', 'operating system', and 'system prompt', all of which appear in ordinary descriptions.
• 'python' matches in a description that merely says the server is written in Python, which is documentation rather than shadowing.
• The broad emitter scans schema property names too, so a parameter named command or a tool with a 'shell' enum value fires without any name collision existing.

How to fix it

1. Check whether your server's config key is one of the eight exact names in the narrow list. If it is, rename it, since that is the finding that matters.
2. If the key is fine, the hit came from the word list. Find which word by reading the finding text, which quotes the matched token.
3. Reword incidental uses: 'executes the query' rather than 'runs the query' clears most of these without losing meaning.
4. Prefix your tool names with the server's domain, for example gh_search rather than search, so nothing competes with a built-in.
5. To suppress, add 'tool-name-shadow' to suppressRules in .mcp-scan.json. Expect a high count from the broad emitter on any normally worded catalog.