MCPP-TOOL09: Confusable or colliding tool names

Family	Tool surface
Default severity	medium
Confidence	high
Mode	passive (default scan)
Spec revisions	all

Why it matters

Names with homoglyphs (a Cyrillic "a" in place of the Latin one) or names identical to another server's tools let a malicious server impersonate a trusted tool; clients that merge tool lists may route calls to the wrong server.

Remediation

Use ASCII tool names, and prefix them with a server-specific namespace to avoid collisions.

References

• MCP Security Best Practices
• Unicode TR #39 Security Mechanisms

Suppressing

# .mcp-posture-ignore
[[ignore]]
check = "MCPP-TOOL09"
target = "https://mcp.example.com/*"
justification = "Why this is acceptable here"
expires = 2026-12-31