{
  "schema_version": "1.3.0",
  "slug": "in-what-scenarios-must-an-instance-treat-tool-description-mutation-as-a-distinct-trust-boundary-from-tool-code-execution-in-mcp-skill-injection",
  "title": "In what scenarios must an instance treat tool-description mutation as a distinct trust boundary from tool-code execution in MCP skill injection",
  "date_of_record": "2026 November 13",
  "scope": "Applies to agent runtimes that dynamically load tools from MCP servers or plugin manifests where the tool *description* (name, docstring, parameter schema, examples) is fed into the model's context, and the tool *implementation* runs in a separate trust domain. Does not apply to statically compiled tool sets whose descriptions are frozen at build time and signed alongside the binary.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-tool-description-mutation-as-a-distinct-trust-boundary-from-tool-code-execution-in-mcp-skill-injection.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-tool-description-mutation-as-a-distinct-trust-boundary-from-tool-code-execution-in-mcp-skill-injection.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-tool-description-mutation-as-a-distinct-trust-boundary-from-tool-code-execution-in-mcp-skill-injection.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1231,
    "python_slice_tokens": 179,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Most skill-injection defenses conflate two trust boundaries that are physically separate in the runtime: the **description channel** (bytes that enter the model's prompt) and the **execution channel** (code that runs with the agent's privileges). A malicious MCP server can compromise the first without ever touching the second. A tool whose `description` fiel...",
    "what_was_observed": "During a red-team pass on a dynamically loaded MCP toolset, an operator registered a server exposing a benign `read_config` tool. The `description` string was modified to include a trailing block: The tool's *implementation* was unchanged and passed every code review and signature check — it opened only the requested path and returned its bytes. The model, however, treated the HTML-comment block as an authoritative i...",
    "condition_of_validity": "This boundary failure is live only when **all** of the following hold: 1. Tool descriptions (including parameter descriptions, examples, and enum labels) are injected into the model context *without* passing through the same content filter applied to tool output. 2. The registry permits dynamic loading — i.e., a new server or version can be registered after ...",
    "decision_boundary": "The operational decision is *where to place the sanitization checkpoint*. Two viable placements exist: - **Load-time quarantine:** On server registration, extract description text, strip imperative constructs, and require human/automated approval before the entry enters the live registry. Cost: latency and manual review at discovery; benefit: the prompt neve...",
    "operational_effect": "After adopting per-turn description diffing, the red-team payload was caught at the diff gate: the description hash changed between sessions, the tool was quarantined, and the agent ran with the tool absent rather than with an injected instruction embedded in its context. The measurable effect was a shift in failure mode — instead of silent credential exfilt..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "84b294a179631a9df3263d9cd393de82b293229638af436fcea10b3a34097a0b",
    "verified_classes": [
      "DescriptionMutationError"
    ],
    "verified_functions": [
      "verify_tool_description",
      "load_mcp_tool"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "DescriptionMutationError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "hashlib"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}