Security researchers are increasingly focusing on the Model Context Protocol (MCP), but most attention remains on tool execution vulnerabilities. A new red-team lab released by developer webofmike shifts the focus earlier in the handshake process, demonstrating that prompt injection attacks can occur during the initial connection phase.

The Pre-Tool-Call Attack Surface

The lab specifically targets the instructions field returned by an MCP server during the initialize and server/discover stages. This is the moment when the client agent establishes context and capabilities. By manipulating this field, a malicious server can inject instructions that persist in the agent's context window before a single tool is ever invoked.

Four Demonstrated Attacks

The repository includes four distinct attack vectors, each tested and verified before publication. These scenarios illustrate how an untrusted server can leverage the trust implicit in the initialization handshake to steer agent behavior. The author notes that every command in the demo repo was run successfully, providing concrete proof-of-concept rather than theoretical risk.

Key Takeaways

  • Early Injection: MCP vulnerabilities are not limited to tool output; the initialize response is a viable injection point.
  • Trust Assumptions: Current client implementations often treat server-discovered instructions as trusted context, creating a blind spot.
  • Reproducible Lab: The attack scenarios are packaged in a runnable demo repo, allowing developers to test their own agents against these specific vectors.

The Bottom Line

If you are building MCP clients, you need to sanitize or strictly scope the instructions field from untrusted servers. The assumption that the handshake is safe is broken; treat initialization data as hostile input until proven otherwise.