Reference
AI agent & MCP security glossary
The terminology around AI-agent security is moving fast. This reference covers the core attack concepts — tool poisoning, tool shadowing, toxic flow, the lethal trifecta — plus the deployment risks Keelix grades on every scan: MCP auto-approval, plaintext secrets, and unvetted servers.
Why these terms matter for deployed agents
Most AI-agent security writing focuses on what happens at development time: analyzing a tool definition before it ships, reviewing an MCP server's source code, scanning its npm dependencies. Those checks matter. But the attack surface that is hardest to reason about is the one that only exists at runtime — the live combination of agent configuration, host permissions, data access, and outbound connectivity that describes the deployed system.
The terms below describe that runtime surface. Tool poisoning and tool shadowing are injection mechanisms. Toxic flow is the pattern of exploitation. The lethal trifecta is the structural precondition. MCP auto-approval, plaintext secrets, and unvetted servers are the deployment-time conditions that turn a theoretical risk into an active one.
Keelix grades all of these deterministically on your deployed box — not in a sandbox, not against a static definition, but against the actual configuration your agents are running under — and folds the result into a single 0–100 posture score you can gate CI on.
Terms
AI Agent & MCP Security Glossary
- Tool poisoning
- An indirect prompt-injection attack in which malicious instructions are embedded in an MCP tool's metadata — typically its description or parameter names. Because the AI agent reads that metadata before invoking the tool, the injected instructions land in the model's context window and are treated as trusted input. A "rug-pull" variant publishes a legitimate tool first, builds adoption, then silently updates the description to include a payload. Learn more →
- Tool shadowing
- An attack in which a rogue or compromised MCP server registers a tool with a name or description that mimics a trusted tool already connected to the agent. Two forms exist: direct shadowing (a malicious server impersonates a legitimate one so the agent invokes the wrong endpoint) and cross-server shadowing (a malicious server injects instructions into its own tool descriptions that modify how the agent uses a completely separate, legitimate server). Learn more →
- Toxic flow
- A sequence of agent tool calls — each individually legitimate — that as a whole takes an environment from attacker-controlled instructions to sensitive data and then to an exfiltration point. Described by Invariant Labs, the security research division of Snyk, in its toxic-flow analysis work. The danger: no single step looks malicious; the threat only appears when you model the full call graph. [Invariant Labs ↗] Learn more →
- The lethal trifecta
- Term introduced by Simon Willison on 16 June 2025 for the three-way conjunction that makes an AI agent critically exploitable: (1) access to private data, (2) exposure to untrusted input, and (3) the ability to communicate externally (exfiltration). When all three are simultaneously present on a deployed agent, a single poisoned piece of content is enough to steal sensitive data — no code vulnerability required. [Simon Willison ↗] Learn more →
- Lethal trifecta: private data access
- The first leg of the lethal trifecta. An agent has access to private data when it can read files, databases, emails, calendar entries, or any other confidential information belonging to the user or the organization. This is often intentional and desirable — the hazard is the combination with the other two legs. Learn more →
- Lethal trifecta: untrusted input
- The second leg of the lethal trifecta. An agent is exposed to untrusted input when attacker-controlled text or images can enter its context window — through web pages it browses, emails it reads, documents it processes, or tool descriptions it loads. This is the injection point: the attacker plants instructions here. Learn more →
- Lethal trifecta: exfiltration channel
- The third leg of the lethal trifecta. An agent has an exfiltration channel when it can communicate externally in a way that carries data out — sending emails, creating web requests, posting to webhooks, writing to shared storage, or calling any outbound-capable tool. This is what turns a data-access vulnerability into a data-breach. Learn more →
- MCP auto-approval
- A configuration state in which an AI agent approves all MCP tool calls without presenting them to a human for confirmation. Surfaces include Claude Code's --dangerously-skip-permissions flag, the enableAllProjectMcpServers setting, and repo-controlled .mcp.json files that pre-authorise tool invocations in CI. Auto-approval is the single largest blast-radius multiplier: a single successful prompt injection escalates from limited manipulation to full, unrestricted tool execution. Learn more →
- Plaintext MCP secrets
- API keys, tokens, and passwords stored in cleartext inside MCP config files — typically ~/.config/claude/claude_desktop_config.json, .mcp.json at the project root, or equivalent paths used by Cursor, Windsurf, and other agent hosts. These files are often world-readable on multi-user systems, committed to version control by accident, or exposed in CI environment dumps. Keelix reads these paths during a scan and redacts any secrets it finds before they appear in the report. Learn more →
- Unvetted MCP server
- An MCP server installed on a box whose publisher has not been verified. Unlike traditional APIs that go through a security review before integration, MCP servers can be installed directly by end users — often from a single npm install or uvx command pasted from a README. An unvetted server has full access to the tool surface and context window of any agent that connects to it, making it an attractive supply-chain attack vector. Learn more →
Frequently asked
- What is the difference between tool poisoning and tool shadowing?
- Tool poisoning embeds malicious instructions in a tool's metadata (description or parameters), hijacking the agent's behavior when it reads those instructions. Tool shadowing registers a fake or rogue tool that impersonates a trusted one, so the agent invokes the wrong endpoint. Both are indirect prompt-injection attacks, but the injection point differs: poisoning corrupts the tool definition; shadowing corrupts the tool registry.
- What is a toxic flow in AI agent security?
- A toxic flow is a sequence of individually innocent tool calls that, when chained, moves an agent from attacker-controlled instructions to sensitive data and then to an exfiltration point. The threat is systemic: none of the individual steps is malicious, but the full path leaks data. Toxic flow analysis requires modeling the entire call graph, not just inspecting each tool in isolation.
- What is the lethal trifecta for AI agents?
- Simon Willison introduced the term on 16 June 2025 for the combination of three properties that make a deployed agent critically exploitable: access to private data, exposure to untrusted input, and the ability to communicate externally. All three must be present simultaneously for a full data-exfiltration attack. Keelix deterministically checks for all three legs on your deployed box. [Simon Willison, Jun 2025 ↗]
- How does MCP auto-approval increase security risk?
- Auto-approval removes the human confirmation step from tool calls. Without it, a successful prompt injection can only cause the agent to attempt an action — the user still sees the approval dialog. With auto-approval active, a single poisoned tool description or injected instruction goes directly to unrestricted execution. The blast radius of any injection expands from manipulation to complete tool takeover.
- Where do plaintext secrets end up in MCP config files?
- AI coding tools like Claude Code, Cursor, and Windsurf store MCP server configurations — including the API keys those servers need to authenticate — in JSON files on disk. The most common paths are ~/.config/claude/claude_desktop_config.json and .mcp.json at the project root. Secrets land there because MCP servers need them at startup, and the config format has no built-in secret-management layer. Keelix scans these paths and flags any keys or tokens it finds in plaintext.
Deep dives
Check which of these risks are live on your box.
Free, local-first, Apache-2.0. Keelix grades tool poisoning risk, auto-approval, plaintext secrets, the lethal trifecta, and more — in under two minutes.
operator@host — keelix
# install — free & open source (Apache-2.0)
$ curl -fsSL https://keelix.dev/install.sh | sh
$ keelix scan