Security signals glossary
When MCP Hub analyzes an MCP server, it raises "signals". Here is what they mean, the risk, and when they can be legitimate.
Read this first. These signals come from the description analysis of tools (first pass). A description signal is not a verdict: a description can look worrying without the server misbehaving, and vice versa. At MCP Hub, only the behavioral pentest — the tool is actually run in an isolated sandbox — decides "Verified" or "Flagged". The glossary helps you understand, not convict.
Signal categories
hidden_instruction
Hidden instruction
- What
- A directive aimed at the AI agent, concealed in a tool's description (low-visibility text, tags, roundabout phrasing).
- Risk
- Making the AI do something other than what the user asked.
- Legitimate when
- Rarely — a genuine tool doc doesn't need to "talk" to the AI covertly.
tool_shadowing
Shadowing another tool
- What
- A tool's description tries to influence the behavior of another, often more sensitive, tool.
- Risk
- Bypassing a trusted tool by "redefining" it on the side.
- Legitimate when
- A tool that references another for good reasons (documented chaining) can trip the signal.
sensitive_file
Sensitive file access
- What
- The description mentions access to sensitive files (SSH keys,
.env, credentials,/etc/passwd…). - Risk
- Reading or leaking local secrets.
- Legitimate when
- A config-management tool may legitimately mention files — hence the behavioral test.
imperative_override
Order to ignore the rules
- What
- Imperative wording meant to override existing instructions ("ignore previous instructions", "you must first…").
- Risk
- Taking control of the agent's behavior.
- Legitimate when
- Almost never in a tool description.
invisible_unicode
Invisible Unicode characters
- What
- Non-displayed characters (zero-width, directional marks) inserted in the text.
- Risk
- Hiding an instruction from the human eye while keeping it readable by the AI.
- Legitimate when
- Almost never — a classic concealment sign.
prompt_injection
Prompt injection
- What
- Text crafted to be interpreted as an instruction by the AI rather than as data.
- Risk
- Hijacking the agent via content, not via code.
- Legitimate when
- A tool that manipulates prompts (e.g. a template library) may trip it — confirm by behavior.
data_exfil
Data exfiltration
- What
- The description suggests sending data outward (URL, unjustified network request).
- Risk
- Leaking information about the user or their environment.
- Legitimate when
- A network tool by nature (sending email, webhook) mentions it legitimately — the pentest checks where data actually goes.
The two analysis layers
Layer 1 — Description
We read each tool's description and raise the signals above. Fast, broad, but indicative: a description can lie.
Layer 2 — Behavior
We actually run the tool in an isolated micro-VM (decoys + blocked network) and watch. This is the directory verdict.
The verdicts
Verified — behaviorally tested, nothing malicious observed. Flagged — malicious behavior caught at pentest (secret read, exfiltration). Not tested — listed, not yet behaviorally pentested. Description signals alone never yield "Flagged".