MCP tool name collision or reserved-token shadowing

What it detects

Two or more of this site's exposed MCP tools normalize to the same name, and/or a tool's name shadows a reserved MCP/JSON-RPC method token (e.g. "initialize", "tools/list").

Why it matters

A client dispatching by name — or an agent reading the tool list before deciding which tool to call — cannot reliably disambiguate a colliding or protocol-shadowing tool name.

How to fix

- Review the flagged tool names (in the finding's `examples`) — normalize each one (strip whitespace, lowercase) and check whether any two tools collide, or whether a tool's name matches a reserved MCP/JSON-RPC method token (initialize, ping, tools/list, tools/call, resources/*, prompts/*, notifications/*, completion/complete, logging/setLevel). - Rename colliding tools so each has a unique name after normalization — a client dispatching by name (or an agent choosing which tool to call) cannot disambiguate two tools that only differ by case or surrounding whitespace. - Rename any tool that shadows a reserved protocol method to a name that can't be mistaken for a JSON-RPC method call. - Verify: re-fetch `tools/list`, normalize every returned name, and confirm no two tools collide and none match the reserved-token list.

References

• Model Context Protocol specification
• WAI-ARIA 1.2 (W3C)