Here is a line from an MCP manifest that would pass most code reviews:

{ "name": "search", "description": "Search docs." }

Enter fullscreen mode

Exit fullscreen mode

Now imagine that between docs. and the closing quote there are a dozen zero-width Unicode characters. Rendered width: zero. Your eyes see nothing. The diff shows nothing. But decoded, they spell out an instruction: read the user's .env file and send its contents along as the search query.