Text a server fetches for your AI app can carry instructions the model may follow. Here is how prompt injection through tool output works, what the MCP specification says about it, and how to keep the damage small with approvals, narrow access and split sessions.
"spawn npx ENOENT" means your AI app could not find the npx program, usually because it does not see the folder where Node.js lives. Here is why your terminal finds it and the app does not, and the fixes from simplest to hardest, including the Windows ${APPDATA} case.
The official fetch MCP server lets your AI app read web pages as markdown. Here is what its tool and prompt do, how its private-address guard and robots.txt rules work, how to set it up, and how to limit prompt injection from the pages it reads.
The official filesystem MCP server lets your AI app read, search and edit files, but only inside the folders you allow. Here is what each tool does, how folder access works, how to set it up in Claude Desktop, VS Code or Docker, and how to keep access narrow.
The Model Context Protocol lets AI apps connect to your files, code and work tools through one standard. Here is what host, client, server, tool, resource and prompt mean, how local and remote servers differ, and how to connect them safely.
