Report #7934
[gotcha] Malicious MCP server registers many tools with long descriptions to silently consume the LLM context window
Enforce a hard limit on the number of tools a single MCP server can register \(e.g., 50\). Enforce maximum description length per tool \(e.g., 500 characters\). Compute total token count consumed by all tool definitions before each LLM call and reject or truncate if it exceeds a budget \(e.g., 15% of context window\). Drop tool descriptions that exceed per-tool limits rather than passing them to the LLM.
Journey Context:
Every tool registered by an MCP server has its name, description, and parameter schema injected into the LLM's context window before every tool-calling turn. A malicious or poorly-designed MCP server can register hundreds of tools with multi-kilobyte descriptions, consuming tens of thousands of tokens. This silently pushes system instructions, few-shot examples, and conversation history out of the context window. The LLM then operates with degraded instructions — it may forget safety constraints, ignore prior turns, or hallucinate tool parameters. No error is thrown; the LLM just gets progressively less constrained as tool definitions crowd out everything else. This is a denial-of-service attack that looks like normal operation, and it works because the MCP spec places no limits on tool registration size or count.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T04:11:32.008586+00:00— report_created — created