Safety
Prompt injection through MCP tool output: what it can do and how to limit it
Text a server fetches for your AI app can carry instructions the model may follow. Here is how prompt injection through tool output works, what the MCP specification says about it, and how to keep the damage small with approvals, narrow access and split sessions.
