← All rules

mcp-scan rule

Unicode injection

unicode-injectionhigh

What mcp-scan saw

Two emitters over the same scan text. The prompt-injection scanner checks for eight characters: U+200B zero width space, U+FEFF byte order mark, U+202E right-to-left override, U+00AD soft hyphen, U+2060 word joiner, U+180E Mongolian vowel separator, U+200C zero width non-joiner, and U+200D zero width joiner. The tool-poisoning scanner checks a narrower set of four direction controls: U+202E, U+200F, U+202B, and U+202D.

Why it fires

These characters change what a human sees without changing what the model reads. A right-to-left override can make a tool description render as one instruction and parse as another, and zero-width characters can carry a payload that survives copy and paste while being invisible in every viewer you would use to review the config.

When this is a false positive

  • U+200D zero width joiner is how modern emoji sequences are built. A family emoji, a profession emoji, or a flag sequence in a description contains one and fires at HIGH.
  • U+00AD soft hyphen and U+FEFF byte order mark arrive routinely from copied text: a soft hyphen from a PDF or a word processor, a BOM from a file saved by a Windows editor.
  • U+200C zero width non-joiner is a required letter-forming character in Persian, Arabic, and several Indic scripts, so any correctly written description in those languages matches.
  • The two scanners overlap on U+202E, so a single right-to-left override produces two findings under this id.

How to fix it

  1. Find the characters before deciding anything. Pipe the config through a hex viewer, or grep with a Perl-mode pattern for the specific code points, since they are invisible in an editor.
  2. If the hit is an emoji joiner or a soft hyphen from a paste, strip it and keep the text. Most editors have a 'remove invisible characters' action.
  3. If the hit is U+202E, U+202B, U+202D, or U+200F, read the surrounding text with the override removed. Direction controls in a config are not a formatting accident.
  4. If the reordered text says something you did not write, remove the server and rotate its credentials.
  5. For a description in a script that needs U+200C, keep it and add 'unicode-injection' to suppressRules in .mcp-scan.json, or ignore that server specifically via .mcp-scan-ignore.