Every MCP tool-poisoning detector is blind on the first tools/list — here's a baseline-free fix
blitzcrieg11 · reddit · 2026-09-12
The author explains a blind spot in MCP rug-pull detection: hashing and diffing tools/list requires a prior baseline, but the very first listing from an unknown server — the most dangerous moment to trust it — has nothing to compare against.
Baseline-free detection: flag invisible characters in tool descriptions, which have no legitimate use:
- Unicode TAG block (U+E0000–U+E007F, invisibly encodes ASCII)
- Zero-width chars (U+200B–U+200D, U+FEFF, soft hyphen)
- Bidi overrides (U+202A–U+202E, U+2066–U+2069)
Three practical rules:
- Report counts only ({"tagblock": 18}); never quote poisoned payloads into audit logs or the SIEM
- Don't flag the private use area — icon fonts use it legitimately
- Walk every string, not just description: nested inputSchema property descriptions and meta are model-visible; exempting meta from hashing is a full bypass
Apache-2.0, runs locally, no telemetry. The author asks for criticism: missed concealment classes, and whether these ranges could false-positive on legitimate servers (homoglyphs are next but prone to false positives).
More from coding & agent
- Indie dev prepping open-source multi-agent code review engine asks how to find first users — are1494 · 2026-09-12
- Running out of context on a large codebase: how to auto-handoff long-running local LLM tasks — Developer-Y · 2026-09-12
- Dev rebuilds Soccer Pinball Pro in 7 days with Astra + Unity CLI — TheMoonMidas · 2026-09-12
- When an MCP tool errors but the side effect already happened, what should the agent trust? — Street-Chest2270 · 2026-09-12
- Penpot: The Open-Source Figma Alternative With 58.5K Stars and an MCP Server — alex_verem · 2026-09-12
- stoat: a single Go binary that lets AI agents spin up and control QEMU VMs safely — Bright-Fun-1638 · 2026-09-12