MCP poison-risk assessment
Flag MCP tools that deserve review.
CodeRifts assesses an MCP tool manifest for poisoning risk and surfaces the tools that are flagged for review.
The threat
MCP tool-poisoning is malicious instruction content hidden in a tool’s description or schema that an agent may ingest as trusted.
What CodeRifts surfaces
The host-facing assessment is per tool. It reports whether a tool is flagged and its named risk level, and identifies the tool or tools that are flagged.
Output, not scoring details
Use the flagged tool and named risk level to decide what needs review. This page does not describe how that assessment is calculated.
How you see it
coderifts lock --check checks a locked MCP manifest against a live one and surfaces this review finding as drift. It is monitor only — it does not block.
That is one of two paths, and the other one blocks. On the change-set path — a preflight_change_set carrying an mcp_manifest or agent_tools artifact — a poisoning finding raises the decision, and a block-tier finding returns BLOCK. lock --check is the monitor; the change-set gate is the gate. What each one reads also differs, and that matters: the change-set path grades only the sentences a change added (narrowed 2026-09-14), while the snapshot path reads every string on every tool. What MCP tool poisoning is describes the attack these paths are for.
coderifts lock --check --locked-manifest mcp.json --live-manifest live.jsonFor the lockfile and manifest-drift workflow, see Agent contract lockfile.
Honest bound
This is a review finding, not an automatic block. It scores risk heuristically; it is not proof that a tool is safe or malicious. On an acting path, agents still branch on execution_action.