- The paper isolates and measures a fidelity gap in MCP where Unicode TAG-block payloads reach the model while remaining invisible in human approval views, with 8/8 techniques delivered, 1/8 evading review, and the result matching its a priori prediction.
- The experimental harness finds that 4/8 techniques evade a baseline sanitizer, while all 8 reach model context, and cross-library testing shows identical outcomes across 32 cells for three independently developed Python MCP server implementations.
- The paper recommends byte-faithful consent, re-consent after metadata mutation, provenance-scoped namespaces, and explicit confirmation for dangerous schema defaults to address separate approval, TOCTOU, naming, and configuration risks.
The Model Context Protocol (MCP) has become the standard mechanism by which coding agents discover and invoke external tools, but its trust model contains a structural weakness: the metadata a human approves and the bytes a model receives are produced by two independent code paths that nothing forces to agree. The paper under review isolates this gap as a single mechanism—concealment encoding—and measures it empirically against a genuine MCP client and server, demonstrating that Unicode TAG-block encoding allows an attacker-controlled payload to be invisible to human review while reaching the model verbatim.
Threat model and motivation
The paper assumes a malicious or compromised MCP server connected to an agent host—the routine case of installing a third-party tool server of uncertain provenance. The attacker controls all tool metadata and tool-call results but has no code execution on the host, no network position, and no ability to modify the client. The goal is to steer the agent into exfiltrating secrets or misusing trusted tools. This threat model is well-motivated for coding agents specifically: their execution context routinely contains unpublished source code, environment variables holding cloud and CI credentials, SSH keys used for git operations, and API tokens pasted earlier in the session. A poisoned tool description does not need to trick the model into composing an exfiltration payload; it only needs to ask, in natural language, for material the agent already has access to.
Three properties of the MCP trust model create the attack surface: metadata is instructions indistinguishable from system-prompt text once in context; consent is one-shot and coarse, rendered from a view that may omit or normalize exact bytes; and definitions are mutable with no protocol-enforced re-consent. The paper's contribution is not a new attack family but the isolation of the property that decides whether existing tool-metadata attacks are visible to the human who is supposed to catch them.
Mechanism analysis: concealment versus approval-view rendering
Before any experiment, the paper derives a model-free, protocol-free prediction from Unicode codepoint assignment alone. The TAG block (U+E0000–U+E007F), defined for language tagging and now deprecated, consists of valid, decodable codepoints for which no mainstream terminal emulator, chat client, or IDE panel ships a font mapping. A rendering pipeline therefore displays nothing for these characters—not even a .notdef tofu box, because they are correctly decoded Unicode without assigned glyphs. A model tokenizer, by contrast, places no glyph-assignment requirement on input; whatever UTF-8 bytes arrive are decoded and segmented like any other text.
This asymmetry is made concrete at the byte level: the ASCII letter e (0x65) maps to U+E0065 via 0xE0000 + (0x65 & 0x7F), whose UTF-8 encoding is the four-byte sequence F3 A0 81 A5. A decoder validates this sequence normally; a renderer fails silently at glyph lookup. The analysis predicts that only a TAG-block-encoded payload evades human review, while payloads written in Basic Latin (visible to every renderer) do not—a prediction tested empirically and confirmed exactly.
Technique set and measurement harness
Eight techniques are implemented across five MCP metadata surfaces:
| ID |
Surface |
Technique |
| T1 |
Description |
Direct <SYSTEM> injection (read ~/.ssh/id_rsa) |
| T2 |
Description |
Cross-tool shadowing (rewrites trusted send_email behavior) |
| T7 |
Description |
Unicode TAG-block concealment |
| T4 |
Input schema |
Confused-deputy credential relay via parameter description |
| T8 |
Input schema |
Dangerous-default coercion (--no-sandbox flags as defaults) |
| T6 |
Tool name |
Namespace collision shadowing trusted built-ins |
| T5 |
Error channel |
Fake "RECOVERY REQUIRED" instruction in error result |
| T3 |
TOCTOU |
Rug-pull mutation after benign approval |
The harness speaks real JSON-RPC/stdio against a genuine client, recording four deterministic protocol-level observations per technique: whether the payload reaches model context, evades a baseline string-matching sanitizer (a conjunctive imperative-plus-sensitive-keyword test over NFKC-normalized text, reproduced verbatim in the paper), evades the human-review render, and triggers protocol-enforced re-approval. To rule out a degenerate detector, 25 representative benign tool descriptions were run through the sanitizer: 0/25 flagged, confirming the 4/8 evasion count reflects genuine evasion rather than indiscriminate rejection.
Results
All 8/8 techniques deliver their payload into the model's context across all five surfaces. Four techniques (T4, T8, T6, T7) evade the baseline sanitizer through distinct routes: T4 and T8 phrase instructions as configuration rather than imperatives, breaking the conjunctive keyword test; T6 requires no instruction text at all; T7 removes the payload from cleartext entirely. Exactly one technique—T7, the TAG-block concealment—evades the human-review render, matching the mechanism analysis's a priori prediction and making it the only technique defeating both defense layers simultaneously. Notably, T4, T8, and T6 remain fully visible in the approval view despite evading the automated defense, showing that surface choice determines sanitizer evasion while encoding choice determines review evasion.
Finally, 0/8 techniques trigger re-approval: the T3 rug-pull mutates a tool description between two tools/list calls with byte-identical names and no consent requirement, exploiting the fact that MCP's list_changed notification is documented for cache invalidation, not re-authorization. Approval-view fidelity and re-consent enforcement are thus independent gaps; closing one does not close the other.
Cross-library validation
To separate protocol-level findings from single-implementation artifacts, the full eight-technique catalogue was re-implemented against three independently developed Python MCP server libraries: the official SDK's low-level Server, the official FastMCP, and the third-party PyPI package fastmcp 3.4.2, which shares no tool-management code with the others. Across all 32 cross-library outcome cells, agreement is total: every technique produces an identical four-bit outcome pattern regardless of serving library. Reproducing T3 required solving the same dispatch problem independently in each high-level library—re-registering the handler rather than merely mutating state—which itself constitutes evidence that the TOCTOU gap follows from conventional implementation patterns rather than one codebase's idiosyncrasy.
The paper is appropriately candid about a residual internal-validity concern: two of the three libraries share the official mcp package's wire-level JSON-RPC types, so cross-library agreement is strongest evidence against tool-management-layer artifacts specifically, and weaker evidence against a hypothetical shared wire-layer bug.
Structural fixes
The discussion distills four independent protocol-level changes, each targeting specific techniques. Byte-faithful consent requires the approval dialog to render the exact bytes the model receives, displaying visible placeholders for codepoints outside font coverage—analogous to browsers' tofu-glyph convention—or rejecting such metadata outright; this closes T7. Re-consent on mutation requires pinning approved metadata hashes and re-prompting when definitions change, mirroring dependency-hash pinning in package managers; this closes T3. Provenance-scoped namespaces prevent third-party servers from shadowing host-trusted tool names, closing T6. Schema defaults are not consent requires explicit user confirmation of dangerous default or enum values, closing T4 and T8. The paper emphasizes that authoring-time defenses such as trusted-description generation and OAuth-enhanced signing schemes are complementary rather than substitutes: a legitimately signed tool can still carry a TAG-block payload invisible to a non-byte-faithful renderer.
Limitations
The harness measures payload delivery and defense evasion, not whether a downstream model acts on a delivered payload; counts cannot be read as attack success rates against deployed models. Both defenses are deliberately simple baselines approximating current shipping guardrails—a semantic classifier or a normalizing renderer would close some measured gaps, so results should be read as a lower bound for minimally-defended clients rather than an audit of any product. The benign corpus is hand-written rather than sampled from production traffic, so false-positive rates on real-world distributions are unestablished. The five-surface technique set is not exhaustive, and marketplace-level security review was not evaluated.
Conclusion
This paper converts a diffuse set of tool-poisoning anecdotes into a single measured mechanism: the fidelity gap between MCP's approval render and its model-delivery path. Its strongest claims are precisely quantified—8/8 delivery, 4/8 sanitizer evasion, 1/8 review evasion matching an a priori prediction, 0/8 forced re-consent, and 32/32 cross-library agreement—and each claim is traceable to deterministic protocol observations rather than statistical estimates. The open questions left are concrete: whether mainstream clients will adopt byte-faithful rendering conventions, and whether the shared wire-layer types underlying the cross-library validation mask any deeper common-mode failure.