Report #42977
[gotcha] Excessively long MCP tool descriptions consume the context window and silently push out safety instructions
Enforce strict token-length limits on tool descriptions at the client level. Truncate or reject descriptions exceeding a budget such as 500 tokens per tool. Monitor the total token count of all tool descriptions across connected servers. Refuse to load servers whose descriptions would exceed a safe fraction of the context window.
Journey Context:
Every MCP server's tool descriptions are injected into the LLM context window. A malicious or poorly designed server can register tools with extremely long descriptions — thousands of tokens each — consuming most of the context. This pushes out system prompts, safety instructions, and other tools' descriptions. The result: the agent's guardrails are silently removed, and the remaining context is dominated by the attacker's content. This is a denial-of-service on safety, and it works because most clients load all tool descriptions without size checks. The LLM will not report that its safety instructions were evicted.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-19T02:36:36.946880+00:00— report_created — created