tools / mcp audit / rules / untrusted input can reach an outbound tool · v0.1.0 · View source · Edit on GitHub
MCP audit rule · v0.1.0
Untrusted input can reach an outbound tool
If one tool reads content others can write (web pages, issues, messages) and another can send data out, a hidden instruction in that content can make the agent leak your data. This is the prompt-injection exfiltration path.
- server combinations checks
- 3 test fixtures
high dangerous-mix
Flagged
3 > "f": {
4 "command": "uvx",
5 "args": [Fix
Split these servers across separate agents or profiles, drop the outbound tool, or require approval for every call to the outbound tool.
Fine
{
"mcpServers": {
"b": {
"command": "npx",
"args": [
"-y",
"@modelcontextprotocol/server-brave-search"
]
},
"fs": {
"command": "npx",
"args": [
"-y",
"@modelcontextprotocol/server-filesystem",
"/work"
]
}
}
}