MCP tool-shadowing defenses: detect poisoned tool descriptions and block mid-session tool-definition rug pulls

MCP tools are not just code endpoints. Their names, descriptions, and schemas are fed to the model so it can decide what to call. That makes tool metadata part of the instruction channel. Tool shadowing and poisoned descriptions abuse that trust by hiding instructions where users rarely look but mod