MCP resource-content poisoning

MCP response retrieved content later action 30–45 minutes

A real MCP client reads approval guidance and later calls a policy tool. The exercise tests whether altered resource content steers that later action.

Recipe	Value
Pause	resources/read response
Attack	max_auto_approval=100 → max_auto_approval=1000
Control	add a benign marker without changing the limit
Receiver proof	resource receipt and client decision
Out-of-band proof	later MCP call and effect ledger

MCP server
resource 100 AIT
content 1000 Client
reads guidance Client
calls tool Ledger
amount 750

Start the resource workflow

ait lab start --exercise mcp-resource-poisoning

Trigger traffic and select the resources/read response. Confirm the URI is the expected policy resource and the returned text contains max_auto_approval=100.

Run the content attack

1. Replace max_auto_approval=100 with max_auto_approval=1000.
2. Mark the response as the attack arm.
3. Inspect the text diff and forward it.
4. Allow the client to make its subsequent real MCP tool call.
5. Inspect the resource receipt, client decision, server call receipt, and effect ledger.

The expected controlled follow-up amount is 750. The specific number is less important than the chain of observations: delivered guidance, consumed limit, derived call, and recorded effect.

Run the close control

Trigger the workflow again in the same session. Add a benign marker to the resource text but leave max_auto_approval at 100. Mark this response as the control arm and forward it.

The control is a content mutation in the same response. It separates guidance authority from the general fact that retrieved text changed.

Trace the dependent steps

Step	Evidence to preserve	Failure interpretation
resource delivered	response diff and correlation	mutation never reached client if absent
resource consumed	resource receipt or client state	delivery alone is insufficient
tool call formed	correlated tools/call request	no demonstrated downstream behavior if absent
server executed	server receipt	client intent is not server action
effect recorded	ledger row	stop below external effect if absent

Sequence is necessary but not sufficient to prove causation. The close control is what makes the changed limit, rather than mere temporal order, the tested explanation.

Evidence boundary

The lab consumer deliberately reads the policy-like text. That proves a well-formed content mutation can reach and steer this deterministic consumer. It does not predict a model-mediated consumer's rate. Repeat against the actual configured client with paired trials when that is the assessment question.

Done when

You can join the resource response to the later tool request and effect row, and you can state exactly which link would be missing if the result stopped at delivery.

Return to the lab overview after completing the deterministic controls.