MCP Server Instructions: How to Test for Prompt Injection

MCP server instructions are optional, server-controlled text strings that clients may place in an LLM’s system prompt, creating a potential prompt-injection path before users issue requests or tools are called. The text distinguishes this server-level risk from tool-description poisoning, noting that instructions arrive during legacy initialization or newer discovery flows and are not covered by tool-definition hashing. A 2026 Fetchgate audit of the official MCP Registry found that 5,462 of 8,235 reachable servers, or 66%, returned instructions, with strings ranging up to 68,669 characters, although their presence alone does not indicate malicious behavior. Because client handling varies, the recommended approach is to test each client with controlled hostile instruction payloads that assess trusted-context placement, size caps, concealment attempts, changes after approval, shared-cache isolation, and consistent protections across protocol versions. The proposed safeguards include labeling instructions as untrusted, enforcing visible length limits, reviewing or pinning changes, preventing cross-user cache reuse, and evaluating actual agent tool calls, requests, and file writes for canary tokens rather than relying on an agent’s stated behavior.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.