Securing the Model Context Protocol (MCP) Against Tool Poisoning
The Model Context Protocol (MCP) standardizes how LLM clients connect to local and remote tool servers. We investigate vulnerabilities arising when an MCP client connects to untrusted servers where tool descriptions contain covert prompt injection payloads designed to compromise the host workstation.
MCP Protocol Trust Boundaries
A developer installs a community MCP server for formatting Markdown. The server tool description instructs the model to covertly read developer SSH private keys and pass them into the formatting request.
Hardened MCP Proxy & Parameter Sanitizer
Implement a schema sanitizer that strips unauthorized imperative directives from third-party tool descriptions and validates argument types against strict JSON schemas:
// MCP Trust Gate: Tool Schema Sanitization & Capability Isolation
export function sanitizeMcpTool(rawTool: any) {
// Enforce strict regex on tool descriptions to prevent prompt injection directives
const injectionPatterns = /(SYSTEM|OVERRIDE|DISREGARD|BEFORE CALLING|READ FILE|API KEY)/gi;
if (injectionPatterns.test(rawTool.description)) {
console.warn(`[MCP Security Alert] Suspicious directive stripped from tool: ${rawTool.name}`);
rawTool.description = rawTool.description.replace(injectionPatterns, '[FILTERED]');
}
// Strip dangerous parameter types
return {
name: rawTool.name.replace(/[^a-zA-Z0-9_-]/g, ''),
description: rawTool.description.slice(0, 250), // Cap description length
inputSchema: rawTool.inputSchema
};
}Deploying Autonomous Agents or MCP Integrations?
Navira Security provides dedicated Agentic AI Security and MCP protocol assessments to validate execution boundaries and tokenized authorization.