Analysis
How I vet MCP servers before trusting them in my agent
Publication date not yet evaluated · Added dev.to
Page published
Coverage timeline
Single-source analysis — one report is available.
Why it matters
MCP tool descriptions and results are untrusted text that bypass input/output guardrails, so defenders relying only on response-side checks miss injection and exfiltration attacks that occur one or two agent steps earlier.
A practitioner explainer describes how MCP tool descriptions, names, and input schemas are injected directly into an agent's context and are read by the model as instructions, enabling indirect prompt injection such as a tool description that tells the agent to email the conversation to an outside address. The author outlines four vetting checks: scanning tool descriptions and schemas for injection, scanning every tool result, watching tool arguments, and enforcing tenant isolation.