AID-H-024: Tool & MCP Resolution Integrity

Version 1.20261015 · Family — navigation only

Enforce deterministic, verified resolution of tools and Model Context Protocol (MCP) endpoints to prevent typosquatting, alias collision, and registry-based misdirection. Resolution must be fail-closed: ambiguous matches require explicit disambiguation rather than best-guess selection. This ensures that when an agent calls a tool, it binds to the exact, authorized namespace, version, and descriptor bytes intended.

Scope boundary

Owns consuming-side resolution of the exact approved tool or MCP identity, namespace, version, descriptor bytes, and contract semantics, including fail-closed handling of ambiguity and drift.

AID-H-028.001: AID-H-024 resolves which logical tool or MCP endpoint is intended; AID-H-028.001 authenticates the selected server transport before connection. Correct logical resolution does not prove transport identity, and a valid connection does not prove that the intended tool contract was selected.

AID-H-034.004: AID-H-024 verifies server-published descriptors from the consumer side; AID-H-034.004 governs what an MCP server is allowed to publish. Publication approval and consuming-side resolution are independent enforcement points.

AID-H-018.002: AID-H-024 decides which approved tool contract a reference resolves to; AID-H-018.002 decides whether the authenticated principal may invoke it for the requested object and action. Resolution establishes identity, not runtime authorization.

Sub-techniques

Threat mappings

MITRE ATLAS

AML.T0010 AI Supply Chain Compromise
AML.T0010.001 AI Supply Chain Compromise: AI Software
AML.T0010.005 AI Supply Chain Compromise: AI Agent Tool
AML.T0011 User Execution
AML.T0011.002 User Execution: Poisoned AI Agent Tool
AML.T0060 Publish Hallucinated Entities
AML.T0074 Masquerading
AML.T0109 AI Supply Chain Rug Pull
AML.T0110 AI Agent Tool Poisoning
AML.T0110.000 AI Agent Tool Poisoning: Definition and Instructions
AML.T0115 Publish Poisoned AI Artifacts
AML.T0115.002 Publish Poisoned AI Artifacts: AI Agent Tools

MAESTRO

Agent Impersonation (L7)
Compromised Agent Registry (L7)
Malicious Agent Discovery (L7)
Inaccurate Agent Capability Description (L7)
Supply Chain Attacks (Cross-Layer)

OWASP LLM Top 10 2026

LLM01:2026 Prompt Injection
LLM03:2026 Excessive Agency

OWASP ML Top 10 2023

ML06:2023 AI Supply Chain Attacks

OWASP Top 10 for Agentic Applications 2026

ASI04:2026 Agentic Supply Chain Vulnerabilities

NIST Adversarial Machine Learning 2025

Cisco Integrated AI Security and Safety Framework

AITech-2.1 Excessive Agency
AITech-4.3 Protocol Manipulation
AITech-9.3 Dependency / Plugin Compromise
AITech-12.1 Tool Exploitation
AISubtech-2.1.2 Capability and Permission Overreach
AISubtech-4.3.1 Schema Inconsistencies
AISubtech-4.3.2 Namespace Collision
AISubtech-4.3.5 Capability Inflation
AISubtech-9.3.1 Malicious Package / Tool Injection
AISubtech-9.3.2 Dependency Name Squatting (Tools / Servers)
AISubtech-9.3.3 Dependency Replacement / Rug Pull
AISubtech-12.1.2 Tool Poisoning
AISubtech-12.1.4 Tool Shadowing

Google Secure AI Framework 2.0 - Risks

IIC: Insecure Integrated Component
RA: Rogue Actions

Databricks AI Security Framework 3.0

Agents - Tools MCP Server 13.18: Tool Poisoning
Agents - Tools MCP Server 13.21: Supply Chain Attacks
Agents - Tools MCP Server 13.22: Excessive Permissions and Scope Creep
Agents - Tools MCP Client 13.26: Malicious Server Connection
Agents - Tools MCP Client 13.29: Insufficient Server Validation