I scanned a poisoned MCP server and decoded its invisible instructions

When an AI app connects to an MCP server, the first thing it does is ask for the list of tools. Each tool comes with a name, a description and a JSON schema for its arguments. All of that text goes straight into the model's context. That means a tool description doesn't just tell the model what a tool does. It can also tell the model what to do,... Weiterlesen: I scanned a poisoned MCP server and decoded its invisible instructions