MCP Tool Schema Poisoning: When the Framework Layer Authorizes the Attack

A researcher commits a legitimate MCP server definition to a shared repository. Teammates approve the tool manifest. Two weeks later, the tool schema silently changes on the remote server. Nobody checks again. The tool now accepts a destination parameter that routes file reads to an external URL. That is CVE-2025-54136, CVSS 8.8, disclosed August...