Tool Poisoning and Supply-Chain Security
The risks hiding in third-party tools, MCP servers, packages, and skills — tool poisoning, rug pulls, and malicious updates — and how to vet what you install.
In September 2025, security researchers found an npm package called postmark-mcp, an MCP server for sending email through the Postmark service. It worked perfectly. For fifteen versions, it was a faithful copy of the real thing. Then version 1.0.16 added a single line that blind-copied every email it sent to an address the attacker controlled. Anyone who had installed it with automatic updates started leaking password resets, invoices, and internal memos, and nothing looked wrong. Postmark had never published the package.
Every MCP server, skill, plugin, and package you add to an agent is code and context you've chosen to trust. This lesson covers the risks hiding in that supply chain: tool poisoning, rug pulls, malicious updates, and look-alike packages. You'll learn how to vet what you install, how to pin it so it can't change under you, and how to contain whatever you can't fully trust.
What your agent's supply chain includes
In traditional software, the supply chain is everything your code depends on that someone else wrote. Agents have a bigger one, and it carries two different kinds of risk.
| Component | Risk as code | Risk as context |
|---|---|---|
| Local MCP servers | Run on your machine with your user's permissions | Tool names, descriptions, and outputs go straight into the model's context |
| Remote MCP servers and connectors | Receive everything the agent sends them | Same as above |
| Skills | Bundled scripts run with your agent's permissions | Instructions the agent follows as if you wrote them |
| Plugins and extensions | Often bundle servers, hooks, and commands together | All of the above |
| Packages the agent installs | Install scripts and imported code run on your machine | Rarely |
| Instruction files in repos you clone | Rarely | An AGENTS.md or rules file is read as trusted guidance |
The "context" column is what makes agents different. A normal library can only do what its code does. An agent component can also talk to the model, and the model reads tool descriptions with nearly the same trust as your own instructions. As the prompt injection lesson explained, any text that reaches the model can steer it. Tool descriptions reach it on every single request.