Tool collision occurs when two MCP tools with the same or confusingly similar name, namespace, or capability are loaded into the same environment. This ambiguity can cause the wrong tool to be invoked — either unintentionally or maliciously. An adversary can register a tool with a colliding name to hijack requests intended for a legitimate tool, leading to data exfiltration, unauthorised actions, or denial of service.

Remediation

• Enforce globally unique identifiers for MCP tools (e.g., manifest hash, publisher ID, namespace).
• Resolve tools by immutable identity rather than human-readable names.
• Use signed manifests and trusted registries with strict namespace ownership policies.
• Implement allowlists and sandbox execution for untrusted or colliding tools.

Metadata

• Severity: medium
• Slug: mcp-tool-collision

CWEs

• 706: Use of Incorrectly-Resolved Name or Reference

OWASP

• LLM01:2025: Prompt Injection
• LLM03:2025: Supply Chain