Resolve MCP Tool Name Collisions
Find duplicate MCP tool names across servers and verify that names, handlers, and scopes remain distinct.
Two MCP servers can expose a tool called search. A model may see both and choose the wrong one, especially if one searches public docs and the other searches private customer records. Naming is a usability boundary, but it also affects the reviewer's ability to trace authority. It does not replace server-side authorization.
Inventory all connected servers for the intended host. Use a stable server identifier plus a stable tool identifier in the operator register. Compare names after any client-side normalization, truncation, or prefixing. A collision may not be obvious from each server's own tools/list response.
Collision register
| Displayed name | Server-qualified identity | Data reached | Decision |
|---|---|---|---|
search | docs.search | Public documentation | Rename or qualify |
search | crm.search | Tenant customer records | Hold until distinct |
getStatus | deploy.getStatus | Build state | Keep if unambiguous |
getStatus | billing.getStatus | Account state | Add specific name |
Use action and object names that reveal the reader's task. A name such as searchCustomerInvoices is clearer than runQuery. Descriptions should say what data the tool can access and what it cannot do. Keep descriptions factual; do not hide a write behind a read-sounding name. OWASP's MCP guidance stresses validation at the server, which remains necessary after a rename.
Test selection and enforcement
Create a synthetic task that needs the public docs tool and another that needs the private customer tool. Record which tool the agent requests. Then call the private tool directly as an unauthorized user. It must deny access even if the model would normally choose the public tool. Try a changed tool order and a catalog refresh to reveal order-dependent behavior.
The release artifact is a qualified registry with names, server IDs, handler references, scopes, and review dates. If a client cannot show qualified identities, make the names distinct before connecting both servers. Do not count a successful model selection as proof that the collision is safe. Recheck after adding another MCP server or changing a tool name, since the catalog is a shared namespace from the agent's point of view.
Know what your agents can reach
Map data access, tool actions and approval boundaries before testing. Use the scope guide, or discuss a review of your AI application.