Rule catalog · Metadata transparency

Tool descriptions do not collide with other registered servers

tool_descriptions_unique_across_serversmediumweight 4Post-handshake

Authored by Stanley Hong · AgentReserve (founder).

No tool description on this server appears on at least one OTHER distinct server in the AgentReserve fingerprint store. Cross-server collisions catch the camouflage pattern where a malicious server clones a benign server's tool description verbatim — and broader campaigns that ship multiple servers all advertising the same suspect description. Companion to `tool_surface_has_no_duplicate_descriptions`, which catches duplicates inside the *same* scan; this rule looks across history.

When this rule runs

Requires a successful MCP `initialize` / `tools/list`. Skipped on perimeter-only scans where the server refused or failed the MCP handshake.

Why it matters

A description shared across two unrelated servers is rarely a benign coincidence: either one is plagiarising another's documentation (the lazy case) or both are part of a coordinated campaign that ships a single payload under multiple names (the rug-pull case). Both warrant operator review before extending trust. The fingerprint store is in-tree; cross-server matching uses an indexed sha256 hash and adds one DB round-trip per scan.

Pass condition

No tool description on the current scan matches a description fingerprint observed on any other server.

Fail condition

At least one tool description on the current scan also appears on a different server's fingerprint store.

Evidence examples

When the rule fails, the report records evidence in roughly this shape:

  • {"hits": [{"toolName": "summarize", "otherServerCount": 2}]}

Remediation

Investigate the collision before extending trust. If you copied a description from another MCP server, rewrite it for your own; if a malicious server has copied yours, file a takedown request and rotate any approvals that matched on the description.

Methodology

This rule belongs to the Metadata transparency dimension. Whether the server identifies itself and documents its tools — and whether the advertised identity matches the wire identity (cert CN/SAN, hostname). Operators need a stable name, a version, and an internally consistent identity claim to perform any kind of audit.

Read the full methodology for how rules are aggregated into a score, how verdicts are decided, and how hard-fail rules override the aggregate.