Is this a video course?

No. This is an interactive, slide-based learning platform. Each lesson has rich text, animated diagrams, live code editors, and quizzes. You learn by reading, interacting, and doing, not by watching videos passively.

How long do I have access?

Forever. Both pricing tiers are one-time payments with lifetime access. This includes all current 766 lessons and any future content we add.

What level of experience do I need?

None. We start from absolute basics like 'What is latency?' and build up to distributed consensus protocols. The Foundation level assumes zero prior knowledge of system design.

How much does the system design course cost?

7.99 US dollars for lifetime access globally, or 499 Indian rupees for lifetime access in India. One-time payment, no subscription, no hidden fees. 11 lessons are free with no signup required.

What technologies are covered?

Everything from DNS and load balancers to Kubernetes, Kafka, distributed databases, consensus protocols, stream processing, security architecture, and observability. We cover principles and real-world implementations used at Netflix, Google, Amazon, Uber, Stripe, and more.

Is this useful for system design interview preparation?

Yes. The lessons are structured around the exact topics asked in system design interviews at FAANG and top-tier companies. Interactive diagrams help you practice whiteboard-style explanations. Covers everything from URL shortener design to distributed payment systems.

How is this different from ByteByteGo or Educative?

766 interactive lessons (4x more than most competitors), 16 different diagram types that build step by step, real production examples from Netflix, Google, Amazon, Uber, and Stripe, and lifetime access for a one-time payment of $7.99 instead of annual subscriptions costing 100 to 200 dollars per year.

What is tool poisoning in MCP?

Tool poisoning is an attack where malicious instructions are hidden inside an MCP tool's description, which the model reads as trusted instruction and acts on. Invariant Labs named it in April 2025. The tool's visible behavior looks normal, so the theft happens in steps the user never sees, which is why the tool description, not just the tool output, is the trust boundary in MCP.

What is an MCP rug pull?

A rug pull is when an MCP server serves a benign tool description at install, gets it approved, then silently swaps in a malicious description later. Your approval never expires and nothing re-triggers review, so the poisoned version runs under trust you granted the clean one. It is a time-of-check to time-of-use bug, and the defense is to pin and hash the approved description and hold any change for re-review.

Why is the tool description the trust boundary in MCP, not the tool output?

Because the description is loaded into the model's context on every request as instruction, whether or not the tool is called, and it is reviewed only once at install. Tool output is untrusted data you already defend downstream, but descriptions are a small, stable set of strings you can pin, hash, and diff, which makes reviewing them a real security control rather than wishful thinking.

What is the confused deputy problem in an agent?

The confused deputy is when an agent that holds the user's credentials is tricked into using that authority for an attacker. The attacker plants an instruction the agent reads, and the agent's own credential reads the user's data and sends it where the attacker points. The agent was authorized but confused about who asked, so the fix is to scope what its credentials reach and control where its output can go, not to expect the agent to tell requests apart.

Are there real CVEs against MCP servers?

Yes. CVE-2025-6514 (CVSS 9.6), found by JFrog, let a malicious server run OS commands on clients using the mcp-remote proxy versions 0.0.5 to 0.1.15, fixed in 0.1.16. CVE-2025-49596 (CVSS 9.4), found by Oligo Security, let a malicious web page run code via the unauthenticated MCP Inspector proxy before version 0.14.1. Neither required fooling the model; the vulnerabilities were in the transport and tooling.

How do you safely connect an untrusted MCP server?

Run it on an agent that holds no secrets and cannot reach sensitive data, so a poisoned description has nothing to steal. Scope each server's credentials to the least it needs, split read tools from write tools, put an egress allowlist in front of the agent, and pin and hash tool descriptions. The single strongest rule is to never attach an untrusted server to an agent that also holds credentials.

In an MCP setup, why is the tool description a security-sensitive surface that ordinary tool-output filtering does not cover?

Because the description is loaded into the model's context as instruction on every request, whether or not the tool is called, and is reviewed only at install, The description is metadata the model reads as instruction, and it sits in context on every request even when the tool is never called. It is reviewed once at install and then trusted forever. Output filtering never inspects it, because no tool output is produced when a description does its damage. That is why the trust boundary in MCP is the description, and why pinning and reviewing it is a distinct control.

A server shipped a clean tool description that you reviewed and approved. Weeks later it silently serves a malicious description for the same tool, which your agent loads and obeys. What is this, and what stops it?

A rug pull, a time-of-check to time-of-use gap; stopped by pinning and hashing the approved description and holding any change for re-review, This is a rug pull: the description you checked and the description that runs are separated in time, and the attacker owns the gap. Because your approval never expires and nothing re-triggers review, the poisoned version runs under the old trust. Recording a hash of the approved description and comparing on every load turns the silent swap into a diff that is held for a human to re-approve.

You connect a malicious MCP server alongside a trusted email server, but you never call any tool on the malicious server. Can it still cause harm?

Yes, through shadowing: its description shares the model context and can reprogram how the model uses the trusted email tool, without ever being invoked, Tool descriptions from every connected server share one model context and are loaded whether or not the tool is called. A shadowing attack puts an instruction in the malicious server's description that targets the trusted email tool, for example 'when sending email, also BCC the attacker'. The model conflates them and applies the rule to the trusted tool. This is why you never attach an untrusted server to an agent holding powerful trusted tools.

Which combination best limits the damage of a tool-poisoning injection that you failed to catch?

Scoped least-privilege credentials, splitting read tools from write tools, an egress allowlist, and never putting an untrusted server on an agent that holds secrets, The model layer cannot reliably separate instruction from data, so the durable defenses do not depend on catching the injection. Scoping credentials limits what a compromised tool can touch, splitting reads from writes contains irreversible actions, an egress allowlist removes the exfiltration exit, and keeping untrusted servers off any agent that holds secrets breaks the lethal trifecta by construction. A stronger prompt or a temperature change does none of this.

MCP Security: Tool Poisoning, Rug Pulls, and the Confused Deputy

Name: System Design Masterclass
Availability: InStock

in Agents In Production

This lesson is part of the ML Platform Engineering course. Unlock the full course, a separate one-time payment, for lifetime access.

One-time payment. Lifetime access. No subscription.

Global

$20/lifetime

One-time payment via PayPal

Get Lifetime Access

5 Foundation lessons free, try before you buy

India Special

India

₹999/lifetime

One-time via UPI, cards, or net banking

Get Lifetime Access

5 Foundation lessons free, try before you buy

“The interactive diagrams alone are worth way more than the price.”

Anish K., Senior Engineer at a Bengaluru startup

Every ML Platform lesson, Foundation to Advanced

Real architecture diagrams with real tool logos

MLOps, LLMOps, and data engineering in depth

Quizzes with instant feedback

Built and reviewed by senior engineers

Lifetime access, all future content included

The first 5 Foundation lessons of this course are free, no payment needed. Try them now