Pith. sign in

REVIEW 2 major objections 5 minor 9 references

MCP lets tool metadata hide instructions from human approval while delivering them to the model; only Unicode TAG-block encoding defeats both defenses.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-11 02:38 UTC pith:NTM3OW7D

load-bearing objection Solid protocol measurement: TAG-block concealment is the only technique that beats both human approval render and a keyword sanitizer, and the outcome pattern is identical across three independent MCP server libraries. the 2 major comments →

arxiv 2607.05744 v1 pith:NTM3OW7D submitted 2026-07-07 cs.CR cs.AIcs.SE

Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol: An Approval-View Fidelity Gap Across Three Independent Server Implementations

Mohammadreza Rashidi This is my paper
classification cs.CR cs.AIcs.SE
keywords Model Context Protocoltool poisoningprompt injectionUnicode concealmentTAG blockconfused deputyagent securityapproval-view fidelity
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Coding agents that use the Model Context Protocol trust tool names, descriptions, and schemas after a one-time human approval dialog, then inject those same bytes into the model on every turn. Nothing in the protocol forces the rendered view and the model-bound bytes to match. This paper isolates that mismatch as concealment encoding and shows, from Unicode codepoint assignment alone, that the TAG block has no glyph in mainstream renderers yet reaches a tokenizer intact. Against a real JSON-RPC/stdio client and three independent server libraries, eight techniques across five metadata surfaces all reach the model; four evade a keyword sanitizer; only TAG-block concealment is invisible to the human while still arriving verbatim; and none trigger re-approval even after a post-consent definition change. The gaps are therefore protocol properties, not single-library bugs, and the structural fix is byte-faithful consent rather than better string matching.

Core claim

Nothing in MCP requires the human approval view and the bytes delivered to the model to match. Concealment encoding exploits that gap: a payload written in Unicode's TAG block is absent from mainstream approval renders yet survives byte-for-byte into the model's tokenizer. Measured over real protocol traffic, all eight techniques reach model context, four evade a representative sanitizer, only the TAG-block technique also evades human review, and re-approval is forced for none of them—even under a rug-pull mutation—reproduced identically across three independent server libraries.

What carries the argument

Concealment encoding: the same instruction written in a character set the renderer displays is visible at approval time; written in the Unicode TAG block (U+E0000–U+E007F), which has no assigned glyph, it is invisible to the reviewer while remaining well-formed input for the tokenizer.

Load-bearing premise

The paper treats a simple keyword sanitizer and a render that strips invisible characters as representative of the defenses real MCP clients ship today.

What would settle it

Find a mainstream MCP client whose approval path already normalizes or visibly marks unassigned-glyph codepoints (or rejects them) and re-run the eight techniques: if TAG-block payloads become visible or blocked while the other outcomes stay the same, the dual-evasion claim for T7 fails for that client.

Watch this falsifier — get emailed when new claim-graph text bears on it.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper isolates a structural fidelity gap in the Model Context Protocol: client approval views and the bytes injected into the model are independent paths over the same untrusted tool metadata, so nothing forces them to match. A model-free Unicode analysis shows that TAG-block codepoints (U+E0000–U+E007F) have no assigned glyphs in mainstream renderers yet survive into a tokenizer. Against a real JSON-RPC/stdio client–server pair, the authors implement eight techniques across five metadata surfaces and record four deterministic protocol-level outcomes per technique. All 8/8 payloads reach model context; 4/8 evade a conjunctive keyword sanitizer; only TAG-block concealment (T7) is invisible in the approval-view proxy while still reaching the model; and MCP forces re-approval for 0/8 techniques under TOCTOU mutation. Re-implementing the catalogue against three independent Python MCP server libraries yields exact agreement on all 32 outcome cells. The baseline sanitizer flags 0/25 benign descriptions. The authors propose byte-faithful consent, re-consent on mutation, provenance-scoped namespaces, and explicit treatment of schema defaults as instruction channels.

Significance. If the result holds under the paper’s stated scope (protocol-level delivery and defense evasion, not model compliance rates), it is a clean and useful contribution to agent and tool-protocol security. The work’s main strengths are (1) a model-free, protocol-free prediction of which encoding defeats human review, grounded only in Unicode codepoint assignment and font coverage (§4, Table 4, Figure 3); (2) a deterministic real-protocol harness with verbatim JSON-RPC traces rather than a simulated client; (3) exact cross-library agreement that separates protocol-level behavior from single-codebase artifacts (Table 6); and (4) honest scoping of the baseline defenses as measurement instruments, not production guarantees, plus a 0/25 benign check that rules out a trivial always-flag detector. The dual-evasion result for T7 and the structural fix list (byte-faithful consent, re-consent on mutation) are actionable for client implementers and for any future MCP revision. The contribution is mechanism isolation and measurement, not a new attack family; that framing is appropriate and strengthens rather than weakens the paper.

major comments (2)
  1. [§3.3, §6, Table 5] §3.3 and §6: The observation ‘evades_human_review’ is operationalized as ‘payload absent from the rendered approval view (invisible characters stripped) yet present in the raw stream.’ This is a proxy (strip-and-compare) rather than an empirical measurement against the approval dialogs of multiple shipping MCP clients. The dual-evasion claim for T7 (1/8) therefore rests primarily on the §4 Unicode/font analysis, with the harness confirming only that the TAG-block bytes are present in the raw stream and absent after stripping. The paper should state this separation explicitly in the results and limitations so that readers do not read Table 5’s Rev column as live multi-client UI testing. The mechanism analysis is strong enough to carry the claim once the operationalization is clarified.
  2. [§7, Table 6] §7 and Table 6: Cross-library validation is performed only on the server side (three Python MCP server libraries). The central mechanism—the approval-view fidelity gap—is a client-side property (render path vs. model-injection path). Server agreement correctly shows that payload delivery is not an artifact of one server codebase, but it does not address client variation in how approval dialogs handle unassigned-glyph codepoints or how different agents serialize tools/list into the prompt. A short additional note (or appendix) documenting which specific client renderers/terminals were checked for TAG-block invisibility, or an explicit statement that client diversity remains future work, would align the validation design with the claim being validated.
minor comments (5)
  1. [Abstract / §1 / §9] §9 already flags that the harness measures delivery, not model action. Consider elevating one sentence of that construct-validity discussion into the abstract or introduction so that readers scanning only the front matter do not over-read the 8/8 ‘reach the model’ count as attack success rates.
  2. [Table 2] Table 2 is populated from titles and abstracts only; the paper is transparent about this. A footnote or one-line caveat in the table caption would further reduce the risk that readers treat the checkmarks as full-text audits.
  3. [§3.3] The 25 benign descriptions (§3.3) are hand-written to span common categories. Stating the category list (or releasing the corpus) would make the 0/25 result easier to re-evaluate against other detectors.
  4. [Figure 1, Figure 4] Figure 1 and Figure 4 are dense; ensuring that the flame/snowflake and color-coding legends remain legible in grayscale print would help.
  5. [Listing 2, §3.2] Listing 2’s tag_encode maps via (ord(c) & 0x7F); a one-line note that this is intentional for the ASCII subset used in the payload (and that non-ASCII would need a different encoding) would prevent a pedantic misreading.

Circularity Check

0 steps flagged

No significant circularity: mechanism prediction is external (Unicode codepoint/font facts) and outcomes are measured protocol-level facts, not fitted or self-defined.

full rationale

The paper's load-bearing chain is (1) a model-free claim that TAG-block codepoints (U+E0000–U+E007F) have no mainstream glyphs yet remain valid UTF-8 for tokenizers (§4, Table 4, Figure 3), then (2) deterministic harness observations on real JSON-RPC/stdio bytes (Table 5: 8/8 ctx, 4/8 base, 1/8 rev for T7 only, 0/8 reap), then (3) exact 32/32 agreement across three independent server libraries (Table 6). Step (1) rests on Unicode assignment and font coverage, not on the harness outcomes or any fitted parameter. Step (2) records protocol-level presence/absence of attacker-chosen bytes under fixed baseline defenses; success is not defined as matching a fitted target. Step (3) is an external consistency check against separately developed codebases. No self-citation is load-bearing (references are third-party). No uniqueness theorem or ansatz is imported from the author's prior work. Defining evades_human_review as absence from a glyph-stripping render is an operational measurement criterion, not a circular derivation: the non-tautological claim is that only the TAG encoding satisfies it while still reaching the model, which is predicted from Unicode facts and then confirmed. The 0/25 benign sanitizer check further shows the baseline is not a detector that rejects everything by construction. Score 0.

Axiom & Free-Parameter Ledger

0 free parameters · 5 axioms · 1 invented entities

The central claim rests on standard Unicode and MCP protocol facts plus a few domain assumptions about how mainstream clients render and inject metadata. There are no fitted free parameters; outcomes are deterministic protocol observations. The paper isolates 'concealment encoding' as a named mechanism but does not postulate new physical or cryptographic entities. Load-bearing background is that TAG-block codepoints remain valid UTF-8 without assigned glyphs in mainstream renderers, and that MCP does not bind approval views to model-delivered bytes.

axioms (5)
  • domain assumption Unicode TAG block U+E0000–U+E007F has no assigned glyph in mainstream terminal, chat, or IDE renderers while remaining valid decodable Unicode for tokenizers.
    Core of the §4 mechanism analysis and the prediction that only T7 evades human review; treated as a property of codepoint assignment and font coverage, not re-measured across every shipping client.
  • domain assumption MCP does not require the rendered approval view and the bytes injected into the model context to match byte-for-byte.
    Stated as a protocol property in the introduction and §2.1; the entire fidelity-gap framing depends on it.
  • domain assumption MCP does not force re-approval when tools/list returns a different definition under the same tool name after prior consent.
    Underpins the T3 rug-pull result and the 0/8 reapproval_forced column; supported by protocol description of listChanged as cache invalidation, not re-authorization.
  • ad hoc to paper A conjunctive keyword sanitizer over NFKC-normalized text is a representative measurement baseline for string-matching guardrails shipped by MCP clients today.
    §3.3 defines baseline_sanitizer with fixed _IMPERATIVE and _SENSITIVE lists; evasion counts (4/8) are relative to this choice, not to production semantic classifiers.
  • ad hoc to paper Presence of payload bytes in the JSON-RPC text a mainstream agent serializes into its prompt counts as reaching model context, independent of whether any specific model acts on them.
    Construct-validity choice in §3.3 and §9.1; deliberately separates delivery from model behavior.
invented entities (1)
  • concealment encoding (as isolated structural mechanism) independent evidence
    purpose: Names the single variable—choice of character encoding that renderers drop but tokenizers accept—that decides whether tool-metadata attacks are visible at approval time.
    Not a new physical object; a conceptual isolation of an existing Unicode/rendering asymmetry applied to MCP. Independent evidence is the TAG-block prediction matching the empirical 1/8 human-review evasion result.

pith-pipeline@v1.1.0-grok45 · 22155 in / 3574 out tokens · 48496 ms · 2026-07-11T02:38:49.738633+00:00 · methodology

0 comments
read the original abstract

The Model Context Protocol (MCP) is the dominant way coding agents discover and invoke external tools. A server advertises each tool through a tools/list handshake that returns a name, a natural-language description, and a JSON input schema. The client renders this metadata once, in a one-time approval dialog, and then injects it verbatim into the model's context on every subsequent turn. Nothing in the protocol requires the rendered approval view and the bytes delivered to the model to match. We isolate that gap as a single structural mechanism, concealment encoding, and show with a model-free, protocol-free analysis that Unicode's TAG block (U+E0000 to U+E007F) has no assigned glyph in any mainstream terminal, chat, or IDE renderer, so a payload written in it is absent from what a human reviewer sees while surviving byte-for-byte into the model's tokenizer. We then measure whether this mechanism actually defeats today's client-side defenses, building a proof-of-concept that speaks the real MCP JSON-RPC/stdio protocol against a genuine client and server. Across 5 distinct MCP metadata surfaces we implement 8 concrete techniques with a deterministic, protocol-level harness. All 8/8 techniques deliver an attacker-controlled payload into the model's context, 4/8 evade a representative string-matching sanitizer, and exactly as the mechanism analysis predicts, only the TAG-block encoding (1/8) is invisible in the human approval view while still reaching the model verbatim. MCP forces re-approval for 0/8 techniques even under a time-of-check to time-of-use rug-pull. To test whether these outcomes are a property of the protocol or an artifact of one server codebase, we re-implement the catalogue against 3 independently developed Python MCP server libraries and find total agreement across all 32 cross-library outcome cells. The baseline sanitizer flags 0 of 25 benign descriptions.

Figures

Figures reproduced from arXiv: 2607.05744 by Mohammadreza Rashidi.

Figure 1
Figure 1. Figure 1: From MCP tool object to model context. A server’s tool metadata is parsed into five independent surfaces, each encoded into a token stack; a [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: The T3 rug-pull reproduced through the reference FastMCP-SDK server’s own dispatch path: the second [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: The same decoded codepoint reaches two independent consumers. T1’s plain-ASCII byte is displayed by the renderer and reaches the model; [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Per-technique outcome matrix across the four harness observations, color-coded by surface (blue: description; purple: input schema; green: tool [PITH_FULL_IMAGE:figures/full_fig_p011_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

9 extracted references · 9 canonical work pages · 6 internal anchors

  1. [10]

    MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers

    Zhiqiang Wang and Yichao Gao and Yanting Wang and Suyuan Liu and Haifeng Sun and Haoran Cheng and Guanquan Shi and Haohua Du and Xiangyang Li , title =. arXiv preprint arXiv:2508.14925 , year =

    work page internal anchor Pith review Pith/arXiv arXiv

  2. [11]

    arXiv preprint arXiv:2601.07395 , year =

    Ruiqi Li and Zhiqiang Wang and Yunhao Yao and Xiang-Yang Li , title =. arXiv preprint arXiv:2601.07395 , year =

    work page arXiv

  3. [12]

    TRUSTDESC: Preventing Tool Poisoning in LLM Applications via Trusted Description Generation

    Hengkai Ye and Zhechang Zhang and Jinyuan Jia and Hong Hu , title =. arXiv preprint arXiv:2604.07536 , year =

    work page internal anchor Pith review Pith/arXiv arXiv

  4. [13]

    arXiv preprint arXiv:2603.22489 , year =

    Charoes Huang and Xin Huang and Ngoc Phu Tran and Amin Milani Fard , title =. arXiv preprint arXiv:2603.22489 , year =

    work page arXiv

  5. [14]

    arXiv preprint arXiv:2509.21011 , year =

    Ping He and Changjiang Li and Binbin Zhao and Tianyu Du and Shouling Ji , title =. arXiv preprint arXiv:2509.21011 , year =

    work page arXiv

  6. [15]

    Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks

    David Mellafe Zuvic , title =. arXiv preprint arXiv:2606.28679 , year =

    work page internal anchor Pith review Pith/arXiv arXiv

  7. [16]

    ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by using OAuth-Enhanced Tool Definitions and Policy-Based Access Control

    Manish Bhatt and Vineeth Sai Narajala and Idan Habler , title =. arXiv preprint arXiv:2506.01333 , year =

    work page internal anchor Pith review Pith/arXiv arXiv

  8. [17]

    Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem

    Hao Song and Yiming Shen and Wenxuan Luo and Leixin Guo and Ting Chen and Jiashui Wang and Beibei Li and Xiaosong Zhang and Jiachi Chen , title =. arXiv preprint arXiv:2506.02040 , year =

    work page internal anchor Pith review Pith/arXiv arXiv

  9. [18]

    Semantic Attacks on Tool-Augmented LLMs: Securing the Model Context Protocol Against Descriptor-Level Manipulation

    Saeid Jamshidi and Arghavan Moradi Dakhel and Kawser Wazed Nafi and Foutse Khomh , title =. arXiv preprint arXiv:2512.06556 , year =

    work page internal anchor Pith review Pith/arXiv arXiv