UpdatedAug 6, 2026

MCP: Untrusted Tool Output

Question Variations

"How does indirect prompt injection reach an agent?"
"Why is output schema validation useful?"
"A search tool returns instructions to disclose prompts and call a payment tool. How do you contain the attack?"

Why This Is Asked

This evaluates whether a candidate understands indirect prompt injection and can enforce trust boundaries around tool results. Interviewers look for structured validation, provenance, independent policy checks, and limits on chained actions.

Key Concepts

Data boundary: Tool results are content, never instructions with authority.
Validation: Parse structured outputs and validate schemas and provenance.
Policy enforcement: Tool calls are checked independently of model reasoning.
Containment: Limit accessible tools, data, and chained actions.

Question Variations

“How does indirect prompt injection reach an agent?”
“Why is output schema validation useful?”
“A search tool returns instructions to disclose prompts and call a payment tool. How do you contain the attack?”

Answers by Technology

+ Add Variant

System DesignImprove this answer ✏️

Expected Answer

I treat search and tool output as untrusted content, even when it resembles an instruction. I prefer structured, schema-validated results with provenance, and the application decides what fields may be used. A result cannot expand the agent’s tool set, bypass authorization, or remove confirmation requirements. I also limit chained calls and sensitive data exposure.

Why It Matters

Indirect prompt injection commonly arrives through retrieved or tool-provided content.

Common Mistakes

Executing instructions found in results: Content has no authority.
Passing raw output into sensitive tools: Validate fields and provenance first.

Follow-up Questions

What stops chained abuse? (Answer: Per-tool policy and bounded capabilities.)
Why schemas? (Answer: They reduce ambiguous, instruction-like output.)