Why Inject Matters
MCP tool descriptions are trusted inputs to AI agents. Adversarial descriptions embedded in tool metadata can redirect agent behavior, exfiltrate data, or cause the agent to invoke attacker-controlled operations — without modifying the model or the application.How It Works
The inject campaign workflow follows five steps:- Select — Choose payload templates by technique or target agent
- Serve — Launch them as live MCP tools via the inject server
- Connect — An AI model connects to the server and receives the poisoned tool list
- Execute — The poisoned tool descriptions redirect the model’s behavior — invoking attacker-controlled operations, exfiltrating data, or hijacking goals
- Score — The campaign runner records and scores outcomes
Built-in Components
- 13 payload templates — Across 3 technique categories: goal hijacking, context manipulation, and data exfiltration
- FastMCP server builder — Dynamic tool registration from YAML payload templates
- Anthropic API campaign runner — Drives a model against the poisoned server with parallel execution
- Heuristic response scorer — Classifies outcomes into 4 categories
Next Steps
- Inject CLI Reference — Command reference for
counteragent inject - Payload Templates — Available payload templates and technique categories
- Campaigns — Running and analyzing injection campaigns