Prompt or metadata injection in MCP tool descriptions
ATR evaluates whether tool descriptions contain instructions that could steer a model.
Why it matters
Instructions can steer execution. Tool descriptions, manifests, and skill instructions are read by a model. A malicious or misleading instruction can shape which actions the model takes.
In the registry
ATR evaluated this on 21 MCP servers in the 20 published reports, as of Nov. 9th, 2026, and found an issue in 2, across 2 reports.
Each report shows the exact file and lines, why the issue matters, and the recommended fix, with a fix prompt you can paste into your coding agent. Browse the reports.
Questions
What does ATR check for prompt or metadata injection?
ATR evaluates whether tool descriptions contain instructions that could steer a model. Each MCP server is assessed against 26 rules: 14 common, one guardrail, and 11 MCP-specific rules.
Why does prompt or metadata injection matter?
Instructions can steer execution. Tool descriptions, manifests, and skill instructions are read by a model. A malicious or misleading instruction can shape which actions the model takes.
How often does the registry find it?
ATR evaluated this on 21 MCP servers in the 20 published reports, as of Nov. 9th, 2026, and found an issue in 2, across 2 reports.
How do I check my own MCP server?
Request a scan at bluerock.io/scan. Your first scan is free. Each MCP server is assessed against 26 rules: 14 common, one guardrail, and 11 MCP-specific rules.
Source: BlueRock, Component Level Security Analysis for MCP Servers, Agent Skills and Plugins (Oct. 22nd, 2026).