MCP Tool Poisoning: A Name Allowlist Is Not Enough

Originally published at webofmike.com on 2026-09-22. The demo repo and every command in it were run before publishing. I built a four-container demo that reproduces an MCP server rewriting its own too