Security: Tool Poisoning, Prompt Injection, and the Trust Boundary

The authorization post controlled who may reach a server. It said nothing about what a server does once reached, and that is the larger problem, because a server is the one party in an MCP session whose words flow straight into the model&rsquo;s context. Tool descriptions and tool results are text the server writes and the model reads. A malicious or compromised server puts instructions there.…