Tool metadata contains prompt injection patterns
A tool description or input schema description contains hidden characters or text that addresses the model.
What it means
MCP clients pass tool descriptions and the descriptions inside input schemas to the model. Whatever stands there is read as context for planning. A description that carries instructions for the model can steer an agent without the user noticing. The check looks for two things: high: characters a person would not see in a catalog, such as zero-width characters, bidirectional overrides and Unicode tag characters medium: visible text aimed at the model, such as <system> style tags, role prefixes like "System:", or phrases like "ignore previous instructions" The medium band works with patterns and can be wrong. A harmless description that says "you must call this tool first" matches too, so read the quoted text before you act on it. The check only sees tools the server lists without credentials. It does not judge what a tool does.
How to fix
Remove hidden characters from every tool description and schema description and add a check for them to your build. Rewrite flagged descriptions so they say what the tool does for a human reader. If you did not write the flagged text yourself, treat the server as compromised until you know where it came from.
Run the check against your own server:
npx -y @patchbay-nebius/agent audit <url-or-directory>No install: scan an MCP server in the browser and get a shareable report.
Disagree with this finding on your server? Open an issue with the --json output. False-positive reports are the most useful feedback.