# mcp-server-discover-instructions-field-can-inject-before-the-first-tool: MCP server/discover `instructions` Field Can Inject Before the First Tool Call (MCP-2026-015)

> MCP server/discover `instructions` Field Can Inject Before the First Tool Call (MCP-2026-015) is a high-severity prompt injection issue in Any MCP client that places server `instructions` into trusted model context. Protocol concern tracked as MCP-, a MCP server. Affected: Any MCP client that places server `instructions` into trusted model context. Protocol concern tracked as MCP-2026-015 (not a CVE). Claude Code documents loading server instructions at session start with a 2KB per-server cap..

- **Canonical URL:** https://catalog.anomity.ai/vuln/mcp-server-discover-instructions-field-can-inject-before-the-first-tool
- **Aliases:** ti-104
- **Severity:** high
- **Attack type:** Prompt injection
- **Component:** Any MCP client that places server `instructions` into trusted model context. Protocol concern tracked as MCP- (MCP server)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-09-18
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/mcp-server-discover-instructions-field-can-inject-before-the-first-tool

## Summary

Mike Moore (@themsquared) published a red-team lab (write-up 11 September 2026; RuntimeWire coverage 18 September 2026) showing that an MCP server's server-level `instructions` field — returned during initialize on older protocol versions and via server/discover on the 28 July 2026 specification — can place attacker-authored prose into an agent's context before any tool call. Moore's harness demonstrates four scenarios (direct override, oversized payload, post-approval instruction change, and cacheScope:"public" cross-caller replay via a deliberately vulnerable proxy); all reach the lab's trusted prompt region when defenses are off. Spec issue MCP-2026-015 (filed 7 August 2026 on the modelcontextprotocol repo, still open as of mid-September) describes the unrestricted instructions field and its interaction with public discovery caching; it is an issue id, not a CVE. An August 28 registry audit cited in coverage found 5,462 of 8,235 responding servers (66%) returned an instructions value. Anthropic's Claude Code docs state server instructions load at session start (capped at 2KB per server), so the direct-injection surface remains even when volume attacks are truncated. The lab does not claim compromise of a named commercial gateway; impact depends on how each client assembles prompts and what tools the agent may invoke.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Any MCP client that places server `instructions` into trusted model context. Protocol concern tracked as MCP-2026-015 (not a CVE). Claude Code documents loading server instructions at session start with a 2KB per-server cap. | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run Any MCP client that places server `instructions` into trusted model context. Protocol concern tracked as MCP-2026-015 (not a CVE). Claude Code documents loading server instructions at session start with a 2KB per-server cap..

## How do I fix it?

Treat MCP server instructions as untrusted data: isolate them from system prompts, cap length, pin approved instruction digests, and fail closed if instructions change mid-session. Deny public cacheScope for instruction-bearing discovery responses at any shared gateway; key caches by server identity and caller/auth context. Prefer allowlisted MCP servers only. For Claude Code and similar clients, review which third-party servers are enabled and assume their instructions enter context at connect time — truncate limits reduce volume attacks but do not remove the injection channel.

## How do I find every machine running Any MCP client that places server `instructions` into trusted model context. Protocol concern tracked as MCP-?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Any MCP client that places server `instructions` into trusted model context. Protocol concern tracked as MCP- and which version, then enforce a policy on it.

## References

- article: https://runtimewire.com/article/mcp-prompt-injection-before-first-tool-call

## Related vulnerabilities

- [forever-security-an-agents-md-planted-in-downloads-got-codex-to](https://catalog.anomity.ai/vuln/forever-security-an-agents-md-planted-in-downloads-got-codex-to) — high
- [CVE-2026-103572](https://catalog.anomity.ai/vuln/cve-2026-103572) — high
- [CVE-2026-108592](https://catalog.anomity.ai/vuln/cve-2026-108592) — high
- [CVE-2026-104120](https://catalog.anomity.ai/vuln/cve-2026-104120) — medium
- [CVE-2026-75130](https://catalog.anomity.ai/vuln/cve-2026-75130) — critical
- [ghostsplice-malicious-mcp-servers-split-one-instruction-across-two](https://catalog.anomity.ai/vuln/ghostsplice-malicious-mcp-servers-split-one-instruction-across-two) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=mcp-server-discover-instructions-field-can-inject-before-the-first-tool