Hidden instructions

What mcp-scan saw

The tool-poisoning scanner matched 50 or more consecutive whitespace characters followed on the same line by ignore, disregard, forget, rules, or instructions. The text searched is the union of server name, description, every argument, and every string inside the tool schemas including nested property names, descriptions, and enum values.

Why it fires

Padding is how an instruction is hidden from a human without being hidden from the model. In a rendered config viewer or a truncated list the 50 spaces collapse and the trailing text scrolls out of sight, but the model reads the raw string at tools/list time and sees the instruction sitting inside a tool description it has been told to trust.

When this is a false positive

• A description formatted with wide column alignment, for example an ASCII table whose rows pad out to a fixed width, followed by a row header containing the word 'rules'.
• Machine-generated schema text where an enum or default value carries a long run of spaces from an upstream template, and a nearby field is named instructions.
• A prompt-template argument that legitimately contains the word 'instructions' after a block of indentation. The match is per line, so indentation only counts when a single line carries 50-plus whitespace characters, which usually means it was generated rather than typed.

How to fix it

1. Dump the raw config for this server and look at the exact string, not the rendered view. cat the file rather than opening it in a formatter.
2. Collapse the whitespace run. If the text after it is something you did not write, remove the whole server and treat the credentials it held as exposed.
3. If it is your own formatting, replace the space padding with a single newline or a markdown table, which reads the same and does not match.
4. Check the tool schemas too, not just the description. The scanner reads nested schema strings, so the padding may be inside an enum or a property description.
5. Re-scan to confirm. The pattern needs both halves on the same line, so breaking the line clears it.