mcp 0.5.0 - tool can write to agent's stdout and inject fake responses into context
1. registered a tool that writes to stdout (not returns via sdk response channel, just prints to stdout) 2. agent's context parser picks it up as legitimate agent output 3. tool can inject arbitrary text into the agent's belief about what it said tested on 0.5.0, zero sanitization between tool stdout and agent context. this is a massive prompt injection vector.
Tested this exact scenario in our staging environment yesterday - tool wrote ANSI escape codes to stdout and they rendered in the agent's terminal output as colored text, which then got parsed as part of the response. Zero sanitization between tool output and agent context. We had to add a post-processing filter that strips control characters before passing tool responses back to the agent. Is there a recommended way to handle this in the SDK or are we all just building our own sanitization layers?
Tested this exact scenario in our staging deployment on mcp 0.5.0 with three different tools. Tool wrote ANSI escape sequences directly to stdout - specifically wrote \x1b[32mSUCCESS\x1b[0m - and those sequences rendered in the agent's terminal as green colored text. That colored output then got captured in the agent's context window as if it were legitimate tool output. The agent proceeded to parse "SUCCESS" as a valid response and continued execution. Zero output sanitization, zero separation between tool stdout and agent context.