17 MCP security attack types across five key MCP assets: prompts, tools, resources, metadata, and configuration - By Ankita Gupta

1. Prompt Injection
– Malicious prompts change how the agent behaves.

2. Tool / Service Misuse (“Confused AI”)
– The agent uses the right tool in the wrong way.

3. Schema Inconsistencies
– Input and output formats don’t match, creating errors attackers can exploit.

4. Slash Command Overlap
– Different commands conflict and trigger the wrong action.

5. Vulnerable Client
– Weak client implementation exposes data or control.

6. MCP Rebinding
– Connections are redirected to an attacker’s server.

7. Man-in-the-Middle
– An attacker intercepts and changes MCP traffic.

8. Tool Shadowing Attack
– A fake tool is registered under the same name as a trusted one.

9. Data Exfiltration
– Sensitive information is taken out through MCP calls.

10. Package Name Squatting (tools)
– A malicious tool is published with a name similar to a real one.

11. Indirect Prompt Injection
– Harmful instructions are hidden in tool outputs or resources.

12. Package Name Squatting (servers)
– A fake MCP server is set up with a misleading name.

13. Configuration Drift
– Security settings are changed over time without being noticed.

14. Sandbox Escape
– A tool or agent breaks isolation and reaches outside resources.

15. Tool Poisoning
– A legitimate tool is compromised and gives unsafe responses.

16. Vulnerable Server
– Security flaws in the MCP server are exploited.

17. Rug Pull Attack
– A tool or server is replaced with malicious code after being trusted.