Tool exfiltration instructions

What mcp-scan saw

Two triggers. HIGH fires on a strong signal (exfiltrate, exfil, steal, leak, transmit credentials, send credentials, delete_everything, forward to) or on a contextual one where send, upload, or POST appears within 50 characters of credentials, password, token, key, secret, database, db, or file. MEDIUM fires separately when the text contains call tool, use tool, then call, follow by calling, invoke tool, or chain to. Both search the whole scan text including nested tool schema strings.

Why it fires

A tool description is an instruction the model follows, not documentation it consults. Text telling the model to send something somewhere, or to chain into another tool afterwards, executes as written the next time the model picks that tool. The proximity window on the contextual pattern exists so that an ordinary description mentioning a database does not read as an exfiltration instruction.

When this is a false positive

• A legitimate upload tool trips the contextual pattern by describing itself accurately: 'upload a file to the workspace' has upload and file within 50 characters.
• A secrets-management server that says 'send credentials to the vault' is the canonical phrasing for what it does, and it matches the strong pattern.
• The MEDIUM chaining trigger fires on any description that documents a workflow, for example 'call tool list_repos first, then call clone_repo'. Documenting call order is normal and useful.
• 'forward to' matches in a mail or proxy server's description where forwarding is the product.

How to fix it

1. Read the finding text: the strong and contextual triggers both report as HIGH, and the chaining trigger reports as MEDIUM, which tells you which shape matched.
2. Find the string in the raw config, including nested tool schemas. If you did not write it, remove the server and rotate the credentials it could reach.
3. For a legitimate upload or forward tool, pin the destination in the server code rather than accepting it as an argument, then say so in the description.
4. For the chaining trigger, move the call-order guidance out of the description and into your own docs, so it stops entering the model's context as an instruction.
5. Re-scan. The two triggers are independent, so clearing the HIGH may leave a MEDIUM under the same id.