MCP tool metadata contains prompt-injection language

What it detects

One or more MCP tool names or descriptions match curated prompt-injection phrasing — imperative overrides, role-hijacking, or tool-shadowing language.

Why it matters

MCP tool metadata is read by the agent's language model before the tool is ever called; injected instructions there can redirect agent behavior without the tool being invoked at all.

How to fix

- Review the flagged tool names/descriptions (in the finding's `examples`) for instructions that try to override an agent's system prompt, claim elevated authority, or direct the agent to ignore other tools, its instructions, or prior context. - Rewrite the flagged metadata so it purely describes what the tool does and what parameters it accepts — MCP tool metadata is agent-consumable context, not a place to instruct agent behavior. - Audit how tool metadata is generated/sourced (hardcoded, templated, or pulled from an external/user-editable source) — metadata sourced from untrusted input is the common root cause of injected instructions appearing here. - Verify: re-fetch `tools/list` and confirm none of the tool names/descriptions contain imperative-override phrasing ("ignore previous instructions", "you are now...", "system prompt:", or language claiming to take priority over other tools).

References

• Model Context Protocol specification
• WAI-ARIA 1.2 (W3C)