mcp prompt injection probe

The problem

Static analysis cannot predict how an agent behaves when a live tool returns attacker-controlled content. Relying on documentation or tool manifests leaves your system exposed to runtime prompt injection that only surfaces during execution.

What it does

• Executes real-world adversarial payloads against live agent and MCP server configurations.
• Tests four specific attack vectors: poisoned tool descriptions, injected tool responses, cross-server tool shadowing, and authority manipulation.
• Captures full tool-call transcripts to identify Partial triggers where an agent claims to resist but still executes the payload.
• Validates client-side runtime defenses, output sanitizers, and human-in-the-loop guardrails under actual attack conditions.

Why this beats prompting it yourself

This skill follows a structured scoring rubric and a battery of mutated payloads, including paraphrasing and encoding variants, that manual testing often misses. It systematically tests the response-injection class responsible for major CVEs in the MCP ecosystem which are difficult to rig by hand.

Use cases

• Red-teaming a new MCP server integration in a staging environment before deployment.
• Verifying that a security patch actually closes a prompt injection hole post-incident.
• Benchmarking an agent's resistance to cross-server shadowing when multiple tools are co-installed.
• Generating runtime evidence for security audits that static code reviews cannot provide.

Known limitations

Requires explicit written authorization and a non-production environment. It is a dynamic probe, not a static pre-install scanner or a source code auditor.