MCP tool descriptions are text. When your agent calls tools/list, the server returns JSON with a description field for each tool. That text goes directly into the LLM's context window. The model reads it, reasons about it, and follows instructions it finds there.

A malicious MCP server puts instructions in descriptions. Your agent follows them....