Answers · MCP security

How do I stop Log-To-Leak style prompt injection through MCP logging tools?

Short answer: Log-To-Leak is a tool-poisoning attack described in 2025-2026 research: a malicious MCP server's tool description tells the agent to call a "logging" or "audit" tool after it finishes its real work, and to pass along the user's request, the other server's name and response, and the agent's own reply. The agent completes the task normally, so nothing looks wrong, while the conversation leaks to the attacker. The researchers report high success rates across several models and servers, and that the defenses they tested left much of the attack working. Because a model cannot be relied on to ignore instructions it reads, the fix belongs in the host: allow only the tools a task needs, treat every tool description and tool result as untrusted data, require confirmation for calls the user did not ask for, and block network egress to anywhere not on an allowlist.

Checklist

1. Per-task tool allowlists: expose only the tools the current task needs, from the servers it needs. A logging, telemetry or "report" tool from an unrelated server should not be callable at all.
2. Treat tool descriptions, schemas and tool results as untrusted data, never as instructions. Watch for wording aimed at the model: always, must, before responding, required for compliance, log the full conversation.
3. Pin and review tool definitions: record a hash of each server's tools/list and alert or re-approve when it changes, since descriptions can change after you install.
4. Require human confirmation for secondary calls the user did not request, especially calls that send data to a different server than the one doing the task, and show the full arguments.
5. Egress allowlists: run local MCP servers in a sandbox or container whose outbound network is limited to the hosts they need, so an injected call has nowhere to send data.
6. Minimize what reaches tools: don't pass whole conversations or other servers' responses as arguments; flag string arguments that contain the user's prompt or another tool's output.
7. Audit: log every tool call with server, tool, argument sizes and destination, and review unexpected cross-server calls.

Why it is hard to spot

• The injected instruction sits in tool metadata the user rarely reads, and it asks for an extra call rather than a wrong answer, so the visible task still succeeds.
• Instruction detectors are an imperfect filter: the paper reports one flagging most benign tool descriptions too, because ordinary descriptions are also written as instructions to the model.
• Host-side authorization does not depend on the model resisting the instruction, which is why it is the control the researchers point to.

Ask Rightshold (free, no key)

Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Before I add this MCP server, is it a listed, vetted app and has its tool list changed recently?”

One-click setup

{
  "tool": "check_listing",
  "arguments": {
    "url": "<the server's URL or repository>"
  }
}

• The MCP health receipts at /mcp-health record, for servers listed on Rightshold, each probe's outcome and tool-definition fingerprint, so a changed tool list is visible. They are liveness facts, not a safety finding.
• Rightshold's own server instructions tell agents that tool results are data, not instructions, and its tools never ask an agent to call another server.

Rightshold does not scan arbitrary MCP servers for injected instructions and does not certify any server as safe; it reports what its store checks and probes actually found.

Sources

• Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol (arXiv)
• MCP specification: Security Best Practices
• OWASP MCP Security Cheat Sheet
• OWASP MCP Top 10

Related

• How to vet an MCP server before installing it
• MCP OAuth wrong-audience tokens
• MCP server health receipts

Not legal advice. Updated 2026-10-29. JSON · Markdown · All answers

curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_...   # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
  -H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'