MCP server/discover `instructions` Field Can Inject Before the First Tool Call (MCP-2026-015)

Mike Moore (@themsquared) published a red-team lab (write-up 11 September 2026; RuntimeWire coverage 18 September 2026) showing that an MCP server's server-level `instructions` field — returned during initialize on older protocol versions and via server/discover on the 28 July 2026 specification — can place attacker-authored prose into an agent's context before any tool call. Moore's harness demonstrates four scenarios (direct override, oversized payload, post-approval instruction change, and cacheScope:"public" cross-caller replay via a deliberately vulnerable proxy); all reach the lab's trusted prompt region when defenses are off. Spec issue MCP-2026-015 (filed 7 August 2026 on the modelcontextprotocol repo, still open as of mid-September) describes the unrestricted instructions field and its interaction with public discovery caching; it is an issue id, not a CVE. An August 28 registry audit cited in coverage found 5,462 of 8,235 responding servers (66%) returned an instructions value. Anthropic's Claude Code docs state server instructions load at session start (capped at 2KB per server), so the direct-injection surface remains even when volume attacks are truncated. The lab does not claim compromise of a named commercial gateway; impact depends on how each client assembles prompts and what tools the agent may invoke.

You are affected if you run Any MCP client that places server `instructions` into trusted model context. Protocol concern tracked as MCP-2026-015 (not a CVE). Claude Code documents loading server instructions at session start with a 2KB per-server cap..

Treat MCP server instructions as untrusted data: isolate them from system prompts, cap length, pin approved instruction digests, and fail closed if instructions change mid-session. Deny public cacheScope for instruction-bearing discovery responses at any shared gateway; key caches by server identity and caller/auth context. Prefer allowlisted MCP servers only. For Claude Code and similar clients, review which third-party servers are enabled and assume their instructions enter context at connect time — truncate limits reduce volume attacks but do not remove the injection channel.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Any MCP client that places server `instructions` into trusted model context. Protocol concern tracked as MCP- and which version, then enforce a policy on it.