Tool names are only unique within one MCP server, so two servers can both expose a tool called search. The spec says clients or proxies that merge tools should disambiguate, for example with a server prefix. Without that, an agent or a rule written for one tool may hit the other.
What the spec says
The tools page states that tool name uniqueness is scoped to a single server. It notes that clients or proxies aggregating tools from multiple servers may see collisions and should implement a disambiguation strategy such as prefixing tool names with a server identifier. It also says the server name from its info is not guaranteed unique and should not be relied on for disambiguation.
Tool names themselves should be 1 to 128 characters using letters, digits, underscore, hyphen and dot.
Why it is a security issue
A name is how people and policies refer to a tool. If a policy says allow search and two servers both provide search, the rule may match both. If an agent is told to use search, the model may choose either.
A malicious or compromised server can exploit this by naming a tool after a trusted one so that approvals and prompts apply to the wrong tool. Related risks include tool description injection and silent tool list changes, which other posts here cover.
Ways to handle it
| Approach | What it does | Weak point |
|---|---|---|
| Prefix with a server id | Names become unambiguous | Needs a trustworthy id |
| Allowlist by server and tool pair | Rules name both | More rules to maintain |
| Separate agents per server | No overlap in one context | More agents to manage |
| Reject duplicates at connect time | Fails loudly | May block legitimate setups |
Practical steps
- Export the full tool list from every connected client and sort by name.
- Look for duplicates and near duplicates, including case differences, since names are case sensitive.
- Write approval and allow rules against the combined server and tool name.
- Display the server name next to the tool name in approval prompts.
- Alert when a new server introduces a name that already exists.
Do not trust the display name
Because the server name is not guaranteed unique, base your rule on something you control, such as the configured connection name or its address, rather than what the server says about itself.
Safeguard includes policies, gates and guardrails for agent tool access, plus a free scan at https://gold.safeguard.sh/scan.
Try it yourself
Look at how a server and its tools are presented during setup, and check whether the server name is shown next to each tool.
Click through it at your own pace, or open it full screen.
Quick check
Are tool names case sensitive?
The spec says names should be treated as case sensitive, so Search and search can be different tools. Treat near duplicates as suspicious.
Whose job is disambiguation?
The spec puts it on the clients or proxies that aggregate tools. If yours does not, add a prefix or a policy layer.
Sources
Last reviewed: 19 October 2026.
