mcp tool descriptions leak info about internal systems if you're not careful
was doing red team exercise on internal agent setup yesterday and realized tool descriptions are leaking way more than we thought. client had tool description like "queries the users_prod database for account status" and another one "fetches data from internal-api-v2.company.internal". llm sees all this in context so now it knows internal hostnames, database names, api versions. in multi tenant setup this could be info leak between customers if tools aren't properly isolated lol
we sanitize all tool descriptions before registration now. strip anything that look like hostname, ip, internal service name. is extra step but way better than leaking topology to context
what exactly leaks - just the description string or does the schema itself expose anything? need to audit our tool registrations now
yeah we hit this last week.... tool descriptions that mentioned "internal-api-gateway" and "legacy-auth-service" got passed straight to context. if you're multi-tenant this is a massive leak
wait what. so if you name your internal services in tool descriptions the llm just sees all of it??
yeah basically. tested this last week and tool descriptions with paths like /internal/v2/auth-gateway all ended up in llm context. imo you should sanitize at registration time not hope the llm ignores it