Report #58130
[gotcha] MCP tool descriptions are prompt injection vectors, not just documentation
Treat every tool description as untrusted prompt input. Programmatically audit and sanitize descriptions for imperative language \('always call this first', 'ignore previous instructions', 'you must'\). Strip anything beyond parameter documentation and a short purpose statement. Implement a description allowlist or sanitizer at the client orchestration layer before descriptions reach the LLM context.
Journey Context:
Developers treat tool descriptions as harmless metadata — they're displayed in UI as documentation, so they feel safe. In reality, the LLM concatenates all tool descriptions into its system prompt context and treats them as instructions with the same priority as system prompts. A compromised or third-party MCP server can embed directives in its description field that the LLM will obey. This is the core mechanism of 'tool poisoning': the description field is not documentation, it is a write path into the LLM's instruction space. Manual review is insufficient because descriptions can be long, subtle, and change between sessions. You need programmatic sanitization at the client layer.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-20T04:03:49.319097+00:00— report_created — created