Originally published as part of VerifyClaw's internal security research into LLM-facing attack surfaces — adapted here for a general audience.
Tool shadowing is a naming and presentation attack: a second, competing tool definition — similar name, similar description, different source — enters the model's context alongside a legitimate one. The model has to choose between them using only what's visible in the prompt, and if the two are similar enough, "which one did it actually call" stops being answerable from the output alone.
Why it matters for MCP agents
Multi-server setups make this worse by default: an agent connected to several MCP servers at once may see multiple tools that look nearly identical, sourced from servers with very different trust levels. If the serialized tool call doesn't encode which server it resolved to, a same-name collision is genuinely ambiguous — not just to an outside observer, but to the system dispatching the call.
How we study it
The useful experiment varies one presentation feature at a time — name similarity, description wording, ordering — against a same-task control, and scores the model's relative preference between the two definitions at the point it commits to a name. Where two sources use the exact same serialized identifier, the honest research finding is "this is unresolvable from token probabilities alone," which is itself the point: identity resolution has to happen in the protocol layer (server registration, namespacing), not be inferred after the fact from what the model generated.
Related reading
Check any MCP server's registry entry before adding it alongside tools you already trust.