Report #13978
[gotcha] Excessively long tool descriptions consume the context window and evict safety instructions
Enforce strict character or token limits on tool descriptions at registration time \(e.g., 500 characters per tool, 10K total across all tools\); reject or truncate descriptions that exceed limits; monitor the total token budget consumed by tool metadata before each LLM call; strip redundant or low-value descriptions when approaching context limits.
Journey Context:
A malicious MCP server can register tools with extremely long descriptions—tens of thousands of tokens—that consume most of the context window. This leaves minimal room for the system prompt \(which contains safety instructions\), user messages, and conversation history. The LLM effectively 'forgets' its safety constraints because they were pushed out of the context. Even without malicious intent, legitimate servers with verbose descriptions can accidentally cause this. The attack is subtle because nothing crashes—the LLM just becomes less safe and more compliant. Most MCP clients do not enforce description length limits because the spec does not mandate them.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T20:19:16.424760+00:00— report_created — created