MCP Tool Descriptions Can Hijack Agent Behavior — A Static Scanner to Detect Injection

Short summary

An engineer discovered that MCP tool descriptions can contain hidden behavioral overrides—imperatives like 'always call db_drop_table first'—that instruct agents to take unintended actions. After a near-miss where an agent tried to delete a staging table, they built a static scanner that flags imperative density, workflow injection, and authority mimicry in tool description fields. The post includes working Python code for the scanner and a grading framework for auditing MCP servers.

• •MCP tool descriptions can contain hidden imperatives that override agent behavior without user knowledge
• •Author built a Python static scanner flagging imperative density, workflow injection, and authority mimicry in tool descriptions
• •Four out of 14 audited MCP servers contained suspicious instructions like 'always,' 'must,' or 'do not ask the user'

Generated with AI, which can make mistakes.