{
  "entry": {
    "kind": "vuln",
    "slug": "mcp-server-discover-instructions-field-can-inject-before-the-first-tool",
    "name": "mcp-server-discover-instructions-field-can-inject-before-the-first-tool",
    "vendor": "Any MCP client that places server `instructions` into trusted model context. Protocol concern tracked as MCP-",
    "description": "Mike Moore (@themsquared) published a red-team lab (write-up 11 September 2026; RuntimeWire coverage 18 September 2026) showing that an MCP server's server-level `instructions` field — returned during initialize on older protocol versions and via server/discover on the 28 July 2026 specification — can place attacker-authored prose into an agent's context before any tool call. Moore's harness demonstrates four scenarios (direct override, oversized payload, post-approval instruction change, and cacheScope:\"public\" cross-caller replay via a deliberately vulnerable proxy); all reach the lab's trusted prompt region when defenses are off. Spec issue MCP-2026-015 (filed 7 August 2026 on the modelcontextprotocol repo, still open as of mid-September) describes the unrestricted instructions field and its interaction with public discovery caching; it is an issue id, not a CVE. An August 28 registry audit cited in coverage found 5,462 of 8,235 responding servers (66%) returned an instructions value. Anthropic's Claude Code docs state server instructions load at session start (capped at 2KB per server), so the direct-injection surface remains even when volume attacks are truncated. The lab does not claim compromise of a named commercial gateway; impact depends on how each client assembles prompts and what tools the agent may invoke.",
    "website": "https://runtimewire.com/article/mcp-prompt-injection-before-first-tool-call",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-09-18",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "mcp-server-discover-instructions-field-can-inject-before-the-first-tool",
      "aliases": [
        "ti-104"
      ],
      "title": "MCP server/discover `instructions` Field Can Inject Before the First Tool Call (MCP-2026-015)",
      "summary": "Mike Moore (@themsquared) published a red-team lab (write-up 11 September 2026; RuntimeWire coverage 18 September 2026) showing that an MCP server's server-level `instructions` field — returned during initialize on older protocol versions and via server/discover on the 28 July 2026 specification — can place attacker-authored prose into an agent's context before any tool call. Moore's harness demonstrates four scenarios (direct override, oversized payload, post-approval instruction change, and cacheScope:\"public\" cross-caller replay via a deliberately vulnerable proxy); all reach the lab's trusted prompt region when defenses are off. Spec issue MCP-2026-015 (filed 7 August 2026 on the modelcontextprotocol repo, still open as of mid-September) describes the unrestricted instructions field and its interaction with public discovery caching; it is an issue id, not a CVE. An August 28 registry audit cited in coverage found 5,462 of 8,235 responding servers (66%) returned an instructions value. Anthropic's Claude Code docs state server instructions load at session start (capped at 2KB per server), so the direct-injection surface remains even when volume attacks are truncated. The lab does not claim compromise of a named commercial gateway; impact depends on how each client assembles prompts and what tools the agent may invoke.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "Any MCP client that places server `instructions` into trusted model context. Protocol concern tracked as MCP-",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Any MCP client that places server `instructions` into trusted model context. Protocol concern tracked as MCP-2026-015 (not a CVE). Claude Code documents loading server instructions at session start with a 2KB per-server cap.",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-09-18",
      "modifiedAt": "2026-09-18",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://runtimewire.com/article/mcp-prompt-injection-before-first-tool-call"
        }
      ],
      "mitigation": "Treat MCP server instructions as untrusted data: isolate them from system prompts, cap length, pin approved instruction digests, and fail closed if instructions change mid-session. Deny public cacheScope for instruction-bearing discovery responses at any shared gateway; key caches by server identity and caller/auth context. Prefer allowlisted MCP servers only. For Claude Code and similar clients, review which third-party servers are enabled and assume their instructions enter context at connect time — truncate limits reduce volume attacks but do not remove the injection channel.",
      "detectedByAnomity": true
    }
  }
}