Originally published at webofmike.com on 2026-09-11. The demo repo and every command in it were run before publishing.
I built a red-team lab for the part of MCP that runs before any tool call: the instructions field a server returns from initialize and server/discover. Four attacks, each run undefended and then guarded, with the outcome of both asserted so the numbers cannot drift away from the code. It is Python standard library only and the whole run takes about four seconds. Code at themsquared/mcp-redteam-lab.
The finding I care about is the one that makes this a gateway problem rather than only a client problem: a shared cache in front of many callers will hand one caller's poisoned discovery response to a different caller who never connected to the hostile server.
What the instructions field is
The spec describes instructions as natural-language guidance that "can be used by clients to improve an LLM's understanding of available tools (e.g., by including it in a system prompt)". That sentence is the whole problem. The field is prose, the client is invited to put it in the system prompt, and it is fully server-controlled with no length limit and no content validation.
