MCP Invocation

Connect-time tool metadata invocation occurs when a synthetic subject is influenced by tool, connector, or Model Context Protocol (MCP) metadata at the moment the tool is made available. MCP is an integration pattern that allows a synthetic subject to discover and use external tools, data sources, and actions through a structured interface.

This invocation does not require the tool to be called. The triggering content may appear in the tool description, server instructions, schema, parameter text, tool list, or other metadata loaded into the synthetic subject’s context during connection or discovery. Once that metadata is visible to the model, it may function as an instruction source.

This creates an elevated exposure condition because the synthetic subject may change behavior before any observable tool execution occurs. A malicious or compromised connector may instruct the synthetic subject to prefer a certain tool, ignore competing tools, request sensitive data, disclose information, alter its reasoning, or prepare a later action before the operator has approved any tool call.

The primary risk is line jumping. The connector-supplied metadata enters the instruction context ahead of the normal approval point, allowing it to influence the synthetic subject before a human reviews a specific action. Human approval may then become ineffective because the synthetic subject has already been steered by the metadata it received at connection time.

A related risk is metadata drift. A tool or server may appear safe when first approved, then later change its description, schema, server instructions, or metadata. If those changes are not detected and re-approved, an already trusted connector can become a new invocation source without a new user prompt or tool execution.

Investigators should review the exact tool metadata loaded into context, tool descriptions, server instructions, schema fields, connector version history, MCP server responses, approval records, tool-list payloads, hidden characters, and behavior changes following connection. Particular attention should be given to instruction-like metadata, invisible Unicode, changed descriptions, cross-server tool shadowing, and behavioral shifts that correlate with connector enrollment rather than a user prompt.

Investigative Relevance

Connect-time tool metadata invocation is relevant because the triggering instruction may enter the synthetic subject before any tool use appears in ordinary logs. An investigation that reviews only executed tool calls may miss the earlier metadata that caused the synthetic subject to behave differently.

This section is especially relevant where synthetic subjects connect to MCP servers, plugins, marketplace tools, internal connectors, tool registries, tool discovery endpoints, or dynamically supplied function definitions.

Cross-server tool shadowing invocation occurs when one MCP server supplies metadata that changes how a synthetic subject interprets, selects, or uses tools from another MCP server. The malicious or compromised server may not need to provide the tool that performs the harmful action; it may only need to influence how the synthetic subject uses a trusted tool.

This invocation creates an elevated exposure condition because trust boundaries between MCP servers may collapse inside the model context. A low-trust server may insert instructions that cause the synthetic subject to prefer, avoid, misuse, or reinterpret tools exposed by a separate trusted server.

The primary risk is cross-server influence. A malicious MCP server may shadow a trusted tool name, redefine expected behavior, inject instructions about another server’s tools, or cause sensitive data to be routed through the wrong tool. The operator may believe the synthetic subject is using an approved integration while its tool selection has been influenced by another server’s metadata.

Investigators should review MCP server inventories, tool namespaces, tool names, descriptions, schemas, server instructions, tool-list responses, connection order, and cross-server tool-call behavior. Particular attention should be given to duplicate tool names, instruction-bearing descriptions referring to other tools, newly connected servers, changed metadata, and tool calls whose selection does not match the operator’s request.

Investigative Relevance

Cross-server tool shadowing invocation is relevant because the effective instruction may originate from a different server than the tool ultimately used. The investigation must reconstruct the full MCP context, not only the tool that performed the final action.

This sub-section is especially relevant where synthetic subjects connect to multiple MCP servers, local developer tools, vendor connectors, marketplace servers, filesystem tools, communication tools, or mixed-trust tool registries.

Hidden terminal-control invocation occurs when a Model Context Protocol (MCP) server supplies tool metadata or tool output containing terminal control sequences that alter what the human operator sees while still leaving instruction-bearing content visible to the synthetic subject. MCP is an integration pattern that allows a synthetic subject to discover and use external tools, data sources, and actions through a structured interface.

This invocation creates an elevated exposure condition because the human-visible display and the model-visible context may diverge. A malicious MCP server may use American National Standards Institute (ANSI) escape codes to hide, overwrite, erase, recolor, or disguise instructions in terminal output. The operator may see benign tool output, while the synthetic subject receives and acts on hidden instructions.

The primary risk is display-layer deception leading to synthetic subject action. A hidden instruction may cause the synthetic subject to recommend malicious package sources, alter code, disclose environment variables, create a backdoor, follow a phishing link, or perform another action that appears unrelated to the visible output. The instruction is not issued directly by the operator, but by content rendered through the MCP tool or server.

A related risk is review failure. Human-in-the-loop controls may be weakened because the reviewer is not evaluating the same content that the synthetic subject received. If tool descriptions or outputs are rendered with terminal formatting, cursor movement, screen clearing, or deceptive hyperlinks, a diligent operator may still miss the effective instruction.

Investigators should review raw MCP tool descriptions, raw tool outputs, terminal logs, rendered output, ANSI escape sequences, hidden Unicode, cursor-control characters, hyperlink escape sequences, tool-call history, and subsequent synthetic subject actions. Particular attention should be given to differences between raw and rendered content, invisible text, overwritten terminal lines, cleared-screen sequences, deceptive hyperlinks, and behavior changes following MCP output.

Investigative Relevance

Hidden terminal-control invocation is relevant because the triggering instruction may be concealed at the display layer rather than in the semantic content alone. The investigation must compare what the synthetic subject received with what the human operator could actually see.

This sub-section is especially relevant where synthetic subjects operate through command-line MCP clients, developer terminals, coding agents, local tool servers, security tools, package-management workflows, or any environment where tool output is rendered in a terminal.

MCP prompt template invocation occurs when a prompt template supplied by an MCP server causes a synthetic subject to act. MCP prompt templates allow servers to provide structured messages and instructions for interacting with language models. Prompt templates can provide reusable instructions, workflows, or task structures that are exposed by a server and made available to the user or client.

This invocation creates an elevated exposure condition because a server-supplied prompt may carry instructions that appear operationally legitimate. The prompt template may define the task, request inputs, structure the workflow, select tools, or frame what the synthetic subject should do next.

The primary risk is server-supplied task steering. A malicious or compromised MCP prompt template may cause the synthetic subject to request sensitive data, invoke unsafe tools, disclose context, bypass policy, or route work through attacker-controlled resources while appearing to follow a normal workflow.

Investigators should review MCP prompt templates, prompt arguments, template provenance, server ownership, prompt version history, user selections, resulting model prompts, and downstream tool calls. Particular attention should be given to prompt templates that request secrets, route data externally, override standing instructions, or cause tool use beyond the apparent task.

Investigative Relevance

MCP prompt template invocation is relevant because the instruction source may be a reusable prompt supplied by a server rather than a direct user instruction. The operator may select a prompt template without understanding the full model-visible instruction it contains.

This sub-section is especially relevant where MCP servers expose slash-command-style workflows, reusable prompts, coding templates, investigation templates, automation prompts, or task-specific prompt libraries.

MCP resource content invocation occurs when content exposed through an MCP resource causes a synthetic subject to act. MCP resources allow servers to expose contextual data, such as files, documents, records, repository content, logs, or other readable material, to the client and model context.

This invocation creates an elevated exposure condition because resource content may be treated as task-relevant context while also carrying embedded instructions. A resource may appear to be a document, file, record, or data object, but contain prompt-like text that directs the synthetic subject to ignore rules, call tools, disclose information, or change behavior.

The primary risk is resource-borne instruction execution. A malicious or low-trust resource may be read as data, but used by the synthetic subject as an instruction source. This is especially significant where MCP resources expose external files, shared folders, repository content, user-submitted records, logs, or other material that may be modified by untrusted parties.

Investigators should review MCP resource reads, raw resource content, source provenance, access permissions, retrieved records, prompt and response logs, and actions following resource access. Particular attention should be given to instruction-like text in resources, hidden or obfuscated content, externally writable resources, and actions that follow resource reads rather than operator prompts.

Investigative Relevance

MCP resource content invocation is relevant because resources can introduce instructions through a data channel rather than a tool description or direct prompt. The synthetic subject may appear to be reading context, while the effective instruction is embedded inside that context.

This sub-section is especially relevant where MCP servers expose filesystems, repositories, documentation stores, ticket systems, customer records, logs, emails, or other resources that may include untrusted or externally influenced content.

MCP sampling invocation occurs when a Model Context Protocol (MCP) server requests that the client or host perform a model completion on the server’s behalf. 

A model completion is the process where a model generates a response from supplied messages, instructions, or context. In this pattern, the MCP server can ask the host model to generate text, reason over supplied content, summarize information, or produce an answer that is then returned to the server or used in the workflow.

This invocation creates an elevated exposure condition because the server is no longer only returning data or exposing tools. It may initiate a model-facing request that causes reasoning, summarization, generation, or tool-adjacent behavior through the client’s model environment.

The primary risk is server-originated model steering. A malicious or compromised MCP server may use sampling requests to introduce instructions, request sensitive context, summarize information it should not receive, or cause the host model to generate content that supports later misuse.

Investigators should review MCP sampling requests, server identity, request payloads, messages supplied by the server, model responses, user consent records, returned outputs, and subsequent server or tool activity. Particular attention should be given to sampling requests from low-trust servers, requests involving sensitive context, unexpected model completions, and server-originated prompts that resemble operator instructions.

Investigative Relevance

MCP sampling invocation is relevant because it allows an MCP server to initiate model activity rather than merely respond to a user-initiated tool call. The invocation source is the server request, and the resulting model output may influence later actions.

This sub-section is especially relevant where MCP clients permit server-requested sampling, agentic workflows, model-in-the-loop tools, server-side planning, or integrations that allow external servers to request completions through the host model.

MCP tool-output invocation occurs when output returned by a Model Context Protocol (MCP) tool causes a synthetic subject to act. MCP is an integration pattern that allows a synthetic subject to discover and use external tools, data sources, and actions through a structured interface.

This invocation occurs after a tool call, when the tool result is returned to the synthetic subject’s context. The output may contain ordinary data, but it may also contain instruction-bearing content that causes the synthetic subject to call another tool, disclose information, alter its plan, or continue a workflow in an unsafe direction.

The primary risk is tool-returned instruction execution. A compromised, malicious, or attacker-influenced MCP tool may return content that the synthetic subject treats as a command rather than as data. This is especially significant where the tool processes web pages, files, tickets, customer records, repository content, database results, or other low-trust sources.

Investigators should review raw tool outputs, tool-call logs, returned content, subsequent tool calls, prompt and response records, and downstream actions. Particular attention should be given to instructions embedded in tool results, external content returned by tools, repeated tool-call chains, and actions that began only after a specific tool output entered context.

Investigative Relevance

MCP tool-output invocation is relevant because tool results can become an instruction source after the operator has already approved or initiated a tool call. The investigation must determine whether the synthetic subject acted on the requested tool result or on instructions embedded inside that result.

This sub-section is especially relevant where MCP tools retrieve webpages, read files, query databases, summarize tickets, inspect repositories, fetch external resources, or return model-visible text from untrusted or mixed-trust sources.