Report #1507
[gotcha] Prompt injection via zero-width or homoglyph characters in MCP tool schemas bypasses human review
Sanitize MCP tool names and descriptions by stripping non-printable characters, zero-width spaces, and normalizing homoglyphs before rendering them for human approval or injecting them into the LLM context.
Journey Context:
When a user reviews an MCP server's tools, they look at the UI rendering of the description. An attacker can embed zero-width characters or use Unicode homoglyphs \(e.g., Cyrillic 'a'\) to hide malicious instructions that are invisible to the human reviewer but parsed perfectly by the LLM. For example, a description might look like 'Searches the web' but contains hidden text instructing the LLM to exfiltrate data. Standard text sanitization at the MCP client boundary is essential to ensure WYSIWYG trust.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-15T00:31:42.013125+00:00— report_created — created