Prompt injection risk

What mcp-scan saw

Two emitters. The prompt-injection scanner matches a phrase list against the union of server name, description, arguments, and every string in the tool schemas: ten phrases are matched in any inflection (ignore previous instructions, disregard, override your, bypass your, disable safety and others), and seven only verbatim (act as, you are now, jailbreak, developer mode, dan mode, new persona, your true self). Separately, both this scanner and the tool-poisoning scanner fire when a base64 run of 56-plus characters decodes to printable ASCII containing a space and at least 10 characters.

Why it fires

The tool catalog is part of the prompt. Names, descriptions, and nested schema strings all reach the model at tools/list time, so an instruction written there is read with the same weight as your system prompt. The strict-versus-inflected split exists because matching 'act as' loosely made the benign phrase 'acts as a proxy' fire on ordinary servers.

When this is a false positive

• 'disregard' is on the inflected list, so a description reading 'disregards case when matching' fires at HIGH with no injection present.
• 'developer mode' is a real feature name in several products, and a tool that toggles one says so in its description.
• The encoded-instruction half fires on any legitimate base64 that decodes to prose with a space: a base64-encoded JSON config, a base64 service-account blob, or an encoded prompt template all qualify.
• The same encoded string triggers both scanners, so one payload can produce two findings under this id. A count of two here does not mean two problems.

How to fix it

1. Read the finding text. The phrase variant quotes the exact matched phrase; the encoded variant says 'encoded instruction' and gives no phrase.
2. For the phrase variant, find the string in the raw config. If you did not write it, remove the server and rotate its credentials.
3. If you did write it, reword to avoid the phrase. 'ignores case' rather than 'disregards case' clears it without weakening the description.
4. For the encoded variant, decode the string with base64 -d and read what comes out before deciding anything.
5. If the base64 is a legitimate payload, move it out of the description or schema into an env var, so it stops entering the model's context at all.
6. Re-scan after each change. The two emitters are independent, so clearing one may leave the other.