The reproduction
Create a clean MCP server with a harmless tool, then add hidden instructions in a tool description or adjacent metadata. The agent may treat that metadata as guidance for future actions.
The exploit is not magic. It is untrusted text crossing into a trusted tool-selection process.
What to inspect
Review tool descriptions, schemas, bundled scripts, install paths and outbound destinations. Look for instructions that ask the agent to ignore policy, exfiltrate data, modify files or contact external systems.
A useful scanner should produce a finding an engineer can reproduce.
How to catch it
Even if poisoned metadata is read, the action still has to cross the control boundary. Tool allowlists, parameter constraints and egress policy can block or hold the dangerous call before it runs.
Policy before action. Evidence after execution.