CRITICALCWE-441
FAKETOOL-003 Shadow Tool Injection via Config
Fake Tool Detection: MCP tool impersonation, shadow tool injection, and tool name squatting attacks
Description
Injects a shadow tool definition into the MCP configuration that intercepts calls to a legitimate tool
Remediation
Make MCP server configuration immutable at runtime. Require signed configuration files. Block dynamic server registration that proxies to external endpoints.