ToolSieve: MCP tool description canonicalisation cuts poisoning by 43%

A researcher froze 1,312 MCP tool descriptions from public servers, poisoned them and measured agent tool calls. Rewriting descriptions into a fixed schema cuts successful poisoning from 13.8% to 7.8% without an LLM judge, though it also lowers task utility.

• Baseline poisoning success rate: 13.8% at top-1
• Schema-only and model-rewrite arms cut leakage by about 43%
• Utility (UCC) drops from 0.828 to ~0.69, with overlapping confidence intervals
• Test set: 367 frozen questions from MCPTox, Swallow-8B-AWQ agent