My MCP Server Only Talks to APIs I Trust. That Doesn't Mean the Data Coming Back Is Trustworthy.

Short summary

A developer realizes that vetting an MCP server's code and API provenance doesn't vet the data it returns—free-text fields like repo descriptions or article titles can carry adversarial instructions straight into an agent's context window. The article identifies a gap in standard MCP security checklists: the trust boundary should extend beyond the server to include response content authored by strangers. The practical fix is treating untrusted API response fields as inert data, never as potential directives for the agent.

• •Vetting an MCP server doesn't vet the data it returns—free-text fields can carry prompt injections
• •Standard MCP security checklists miss the gap between server trust and payload trust
• •Untrusted API response content should be treated as inert data, never as agent directives

Generated with AI, which can make mistakes.