Threat explainer
Tool poisoning, overbroad permissions, and shadow MCP servers.
MCP lets agents use tools. Bad tools can lie or overreach.
MCP risk clusters around tool description poisoning, token exposure, command injection, and audit gaps.
HOL Guard turns these moments into private receipts first, then public lessons only after redaction and moderation.
Protect the coding tools your team already uses without forcing everyone to become a security expert.
Real protection moments, scrubbed for safety before becoming public learning pages.
A redacted example of a local secret read attempt.
Why it was risky
Env files often hold API keys or service credentials.
What Guard did
HOL Guard paused the read before file contents left the machine.
A redacted example of an MCP tool with a misleading description.
Why it was risky
The tool description asked the agent to read credentials and pass them as arguments.
What Guard did
HOL Guard paused the tool call and flagged the description for review.
A redacted example of a prompt injection via a file comment.
Why it was risky
The instruction was embedded in an HTML comment invisible to the developer.
What Guard did
HOL Guard paused the command and showed the source of the instruction.
A redacted example of a supply-chain attack via npm install.
Why it was risky
Postinstall scripts run with full permissions before anyone reviews the code.
What Guard did
HOL Guard paused the install and showed the script contents.
Practice attack patterns with static simulations. Nothing dangerous executes.
MCP tool poisoning is when a tool description or schema is malicious or misleading, so the model treats the tool as more trustworthy or capable than it is. Those descriptions can steer planning before a call runs. This hub covers that risk in HOL words; it is not a copy of the OWASP MCP Top 10 long-form text.
Partially. HOL Guard can require approval when an MCP server changes and when a plugin or skill is installed. Cursor native approvals remain Cursor-owned. Cursor/artifact trust is not full pre-exec of every tool description. Guard is not a complete prompt-injection preventer and does not stop prompt injection before the model reads it.
No. A scan is not a safety guarantee. The current public catalog scanner is registry-broker-fallback static scoring, not a live exploit test. About 205 catalog plugins are not Registry Broker agent counts.
No. HOL Guard is local-first runtime control on the developer machine for shell, secrets/file reads, MCP server change, and plugin/skill install. It is not a cloud MCP gateway.