MCP: Untrusted Servers and Confused Clients, Plus a Sneaky Exploit

<p>The <code>Model Context Protocol</code> (MCP) is a protocol definition for how LLM apps/agents can leverage external tools. I have been calling it <code>Model Control Protocol</code> at times, because due to prompt injection, MCP tool servers control the client basically.</p> <p>This post will explain in detail why that is, and I will also share a novel exploit chain.</p> <h2 id="why-mcp---how-