Analysis · curated 11 Aug 2026
How I vet MCP servers before trusting them in my agent
First reported dev.to
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
MCP tool descriptions and results are untrusted text that bypass input/output guardrails, so defenders relying only on response-side checks miss injection and exfiltration attacks that occur one or two agent steps earlier.
A practitioner explainer describes how MCP tool descriptions, names, and input schemas are injected directly into an agent's context and are read by the model as instructions, enabling indirect prompt injection such as a tool description that tells the agent to email the conversation to an outside address. The author outlines four vetting checks: scanning tool descriptions and schemas for injection, scanning every tool result, watching tool arguments, and enforcing tenant isolation.