MCP Tool Descriptions Leak SSH Keys

MCP’s trust model is too loose: it treats remote tool JSON as documentation, while the model treats it as instructions. That gap is enough to turn a harmless-looking server into a credential-stealing channel.

• –Tool descriptions are part of the model context, so hidden instructions can steer behavior without any explicit user prompt injection
• –The attack is broader than one field: parameter names, nested schema text, and dynamic `tools/list` updates all widen the blast radius
• –A one-time approval dialog is not enough if tool definitions can mutate later without re-consent
• –Defenses need to move below the model layer: schema scanning, hash pinning, drift detection, and network-side monitoring
• –This is a reminder that MCP turns “developer convenience” into “attack surface” unless servers are treated as untrusted by default