WebMCP tool metadata contains prompt-injection or obfuscated language

What it detects

A WebMCP tool's name or description matches curated prompt-injection phrasing, or contains hidden/obfuscated Unicode characters.

Why it matters

WebMCP tool metadata is agent-consumable context read before any tool is invoked — the same injection/hiding risk that applies to server-side MCP tool metadata applies here.

How to fix

- Review the flagged tool names/descriptions (in the finding's `examples`) for instructions that try to override an agent's system prompt, claim elevated authority, or direct the agent to ignore other tools or prior context. - Strip any zero-width characters (U+200B-200D, U+FEFF), bidi-override control characters (U+202A-202E, U+2066-2069), or private-use-area codepoints from every tool name and description. - Rewrite the flagged metadata so it purely describes what the tool does — WebMCP tool metadata is agent-consumable context, not a place to instruct agent behavior. - Verify: re-evaluate the page's registered WebMCP tools and confirm no name/description contains injection phrasing or hidden/obfuscated characters.

References

• Model Context Protocol specification
• WAI-ARIA 1.2 (W3C)