Security audit findings — tool description injection + missing output sanitization

Hi MCPJam team,

I recently ran a security audit on **MCP Inspector** as part of research on MCP tooling security posture.

Found a couple of items worth flagging:

**1. Tool description injection risk**
The inspector renders tool descriptions from any connected MCP server without validating them against adversarial patterns. As a debugging/development tool, developers often connect to untrusted or third-party servers — a poisoned tool description could redirect the inspector's LLM into leaking session data or executing unintended operations.

**2. Missing output sanitization**
Tool outputs displayed and forwarded to the model context aren't scanned for injection patterns. Since the inspector is commonly used to test server behaviour, this is a high-value target for demonstrating the attack class.

Both are in a full audit report — 8-page PDF with CVSS ratings, EU AI Act mapping, and remediation steps — for $29 at luciferforge.github.io/mcp-security-audit/

Demo: https://luciferforge.github.io/mcp-audit-reports/

— Lucifer / LuciferForge Security