Two injection paths matter for MCP
Tool poisoning places hostile instructions in tool names, descriptions, schemas, examples, or other metadata the model reads during discovery. Indirect prompt injection arrives through documents, websites, databases, messages, or other content returned by a tool.
Filtering text alone is not a complete defense. The surrounding system also needs least privilege, explicit policy for sensitive actions, isolation, user approval where appropriate, and evidence that shows which decision was made.
- Review tool manifests before they enter an agent’s context.
- Treat external tool output as untrusted content.
- Require policy approval before sensitive tool execution.
- Separate detection claims from verified containment behavior.
Bindfort’s current and planned role
Bindfort’s verified path currently centers on policy decisions and receipt evidence for controlled MCP calls. Its broader product direction includes tool-manifest validation, dangerous-pattern detection, drift review, and runtime containment.
Those broader controls should not be interpreted as generally available production protection today. The public research explains the attack surface; guided evaluations test the narrower policy and evidence path.
Product status
Verified today and clearly separated from roadmap
- Public defensive guidance on MCP tool poisoning and indirect injection.
- Controlled policy denial before selected MCP tool execution.
- Receipt evidence for post-run review and integrity verification.
- A guided assessment using non-sensitive test inputs.
- Packaged tool-manifest and schema inspection policies.
- Broader output sanitization and injection-detection coverage.
- Runtime containment for compromised or manipulated tool paths.
Frequently asked questions
Clear answers for evaluation
What is prompt injection in an AI agent?
Prompt injection is untrusted content that attempts to change an agent’s instructions or actions, including content retrieved through tools.
What is MCP tool poisoning?
Tool poisoning is the use of malicious or misleading instructions inside MCP tool metadata such as descriptions, parameter names, or schemas.
Can one detector stop every prompt injection?
No. Effective protection combines content handling, least privilege, policy enforcement, isolation, approvals, monitoring, and incident response.