theriac: Structural Detection and an Evasion-Robustness Evaluation for Tool Poisoning in the Model Context Protocol

Model Context Protocol (MCP) servers advertise tools, prompts, and resources to language-model agents through natural-language descriptions that the model reads in full but that clients typically do not render in full to the user. This gap enables tool poisoning: instructions embedded in metadata that steer an agent without the tool's own code ever executing. We present theriac, a static analysis scanner that detects poisoned metadata across all three MCP surfaces using structural co-occurrence rules rather than keyword matching, motivated by the finding that effective poisoning payloads combine a trigger condition, a malicious action, and a plausible justification. We evaluate theriac on three independent axes: recall on a held-out split of the external MCPTox benchmark (45 real servers, 353 tools), which improves from 8.1% to 87.3% across three rule-development iterations without the holdout split ever being tuned against; false-positive rate on eight published MCP servers not involved in development, which remains at zero above low severity across 130 scanned components; and survival of detected attacks under character-level evasion — Cyrillic homoglyphs, invisible Unicode, whitespace padding — which rises from 42% to 100% after a text-normalization pass. We argue that detection recall alone is an incomplete way to evaluate a tool-poisoning scanner, and propose false-positive rate on unmodified real servers and evasion-survival rate as two additional axes future scanners in this space should report alongside it.