UC-013: Poisoned MCP Tool Description

Layer: A — Surface Containment Threat: Tool Poisoning (OWASP MCP)

Scenario

An MCP server returns a tool description containing a poisoned tool name that is not in the agent's capability manifest. HELM must deny the call.

Expected Behavior

• Tool call for undeclared tool → DENY_TOOL_NOT_FOUND
• Signed deny receipt produced with reason code
• ProofGraph node created for the denial

Pass Criteria

• Verdict: DENY
• Reason code: DENY_TOOL_NOT_FOUND
• Receipt: signed, valid Ed25519
• Tool never reaches executor