MCP Prompt Template Invocation

MCP prompt template invocation occurs when a prompt template supplied by an MCP server causes a synthetic subject to act. MCP prompt templates allow servers to provide structured messages and instructions for interacting with language models. Prompt templates can provide reusable instructions, workflows, or task structures that are exposed by a server and made available to the user or client.

This invocation creates an elevated exposure condition because a server-supplied prompt may carry instructions that appear operationally legitimate. The prompt template may define the task, request inputs, structure the workflow, select tools, or frame what the synthetic subject should do next.

The primary risk is server-supplied task steering. A malicious or compromised MCP prompt template may cause the synthetic subject to request sensitive data, invoke unsafe tools, disclose context, bypass policy, or route work through attacker-controlled resources while appearing to follow a normal workflow.

Investigators should review MCP prompt templates, prompt arguments, template provenance, server ownership, prompt version history, user selections, resulting model prompts, and downstream tool calls. Particular attention should be given to prompt templates that request secrets, route data externally, override standing instructions, or cause tool use beyond the apparent task.

Investigative Relevance

MCP prompt template invocation is relevant because the instruction source may be a reusable prompt supplied by a server rather than a direct user instruction. The operator may select a prompt template without understanding the full model-visible instruction it contains.

This sub-section is especially relevant where MCP servers expose slash-command-style workflows, reusable prompts, coding templates, investigation templates, automation prompts, or task-specific prompt libraries.