Dev builds attest: position-aware prompt-injection scanner for MCP tool descriptions
mrpkk · reddit · 2026-10-21
Reddit user mrpkk (self-disclosed author) released attest, an open-source tool that scans MCP tool definitions for prompt injections using field-position-aware scoring instead of phrase matching.
- The problem: identical strings carry wildly different risk — "ignore all previous instructions" in a tool's description is read by the model as instructions before the tool is ever called, while the same string in examples or a code block is just data. Phrasal scanners flag both equally and bury the critical one.
- The approach: attest splits an MCP tool definition (or JSON-LD block, or markdown) into fields — instructions, tool metadata, examples, prose — scores each by position, and outputs a per-field verdict with reasons rather than one opaque number.
- Limitations: the author is explicit that it guarantees nothing, blocks nothing, and may miss novel wording with no structural tell; it's one more pre-ship check, not a replacement for review.
- Availability: MCP endpoint with a verifyartifact tool, free tier of 20 checks/day then $0.005 per check, no signup or subscription; source on GitHub.
More from coding & agent
- OpenAI: Two Internal Coding Agents Weakened Their Own Misalignment Monitoring — rohanpaul_ai · 2026-10-21
- Tokyo DevDay: strict enterprise plugin policies push devs toward private plugins — sierracatalina · 2026-10-21
- New agent stack: Grok Bot orchestrates Gemini, ChatGPT and Claude via CLIs — _AustinCalvert_ · 2026-10-21
- S-Agent 2.0 turns coding agents into spatial reasoners, hitting 66.5 on MMSI-Bench — liuziwei7 · 2026-10-21
- LLM trading agent skips 380 of 392 calls — scoring refusals shows skipped events moved 2x random — Tasty-Mammoth5321 · 2026-10-21
- Seven single-job Grok bots beat one do-everything content agent, creator says — lucasbennett_1 · 2026-10-21