AI Governance Institute
← News
Research2026-09-02

MCP Server Audit Finds Context Injection Across 19 Servers, Including Active Prompt Injection in Context7

What happened

Digital Applied published We Audited What 19 MCP Servers Put in Your Agent's Context, a first-party empirical review examining how MCP servers deliver content into agent context windows and whether that content includes unexpected or adversarial instructions. Across 19 servers reviewed, the audit found that tool outputs frequently include material beyond the declared function of the server, including content capable of redirecting agent behavior. A specific prompt injection vulnerability was disclosed in Context7, a widely used MCP server for documentation retrieval. The audit follows a pattern of MCP-specific disclosures that have accumulated throughout 2026, including 91.8% of audited MCP servers lacking OAuth controls and active exploitation findings from NIST's DNS rebinding flag on MCP servers. The core finding is that MCP servers represent an untrusted data source injected at a privileged position in agent workflows, and current enterprise onboarding processes do not treat them as such.

Why it matters

  • ·Context injection through MCP servers bypasses agent permission boundaries and prompt injection defenses that enterprises have implemented at the model layer, meaning tool-level controls are the missing piece and existing security architecture does not compensate for absent server-side vetting.
  • ·Any agent workflow that relies on MCP tool outputs without adversarial pre-testing is operating with an unverified input surface; in regulated industries, this creates traceability and accountability failures because the agent's reasoning and actions cannot be cleanly attributed when the context has been silently altered.
  • ·The Context7 disclosure puts enterprises using that server on immediate notice of a confirmed injection path, but the broader finding -- that unexpected context is a common MCP server behavior rather than an exception -- means the vendor due diligence obligation extends to every MCP server in the agent toolchain, not just one.

Governance controls affected

AGT-002Agent Prompt Injection DefenseAGT-010Agent Knowledge Source IntegrityAGT-019AI Tool and Plugin Supply Chain Risk AssessmentAGT-006Agent Action Audit TrailPRC-003Third-Party AI Model Evaluation

What to do now

  • ☐Compile a complete inventory of every MCP server currently connected to agent workflows, including those introduced by individual teams or developers without formal approval.
  • ☐Pause or isolate any agent workflows using Context7 pending review of the disclosed prompt injection issue and confirmation that a patched or mitigated version is in use.
  • ☐Establish a pre-onboarding review gate for MCP servers that includes adversarial context inspection: feed test prompts through the server and examine the full context returned to the agent before approving the integration.
  • ☐Update vendor due diligence questionnaires and contractual requirements to cover MCP server behavior, including disclosure obligations for any server-side instructions injected into agent context.
  • ☐Add MCP server outputs to the scope of your agent action audit trail so that injected context is logged alongside agent decisions, enabling post-incident forensic reconstruction.

What to watch next

Compliance teams should monitor whether the Context7 maintainers publish a formal patch and security advisory, and track whether other widely used MCP servers named in the Digital Applied audit receive similar disclosures in follow-on research. The accumulation of MCP-specific findings in 2026 -- spanning OAuth gaps, DNS rebinding, ANSI escape injection, and now context injection at scale -- signals that standards bodies and regulators may move toward formal MCP server security requirements; teams should watch the OWASP Top 10 for Large Language Model Applications update cycle and the MCP project's own sandboxing baseline for enforceable guidance. Enterprises that have signed onto voluntary AI safety commitments should also assess whether their current MCP posture is consistent with the tool integrity expectations embedded in those frameworks.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Enforcement2026-09-04

SSH MCP Command Classification Flaw Breaks Human Approval Gate Assumptions

A critical advisory has identified a flaw in an SSH MCP server implementation where a command could be classified as safe while the remote shell executed a different, more privileged command. The vulnerability breaks read-only workflow assumptions that enterprise approval gates depend on. Compliance teams are advised to treat command classification, server provenance, and approval workflows as controls requiring independent validation.

Research2026-08-26

CVE-2026-75130: A CVSS 9.0 MCP Bug With No Documented Fix

Security researchers at Digital Applied have documented a critical prompt injection vulnerability, CVE-2026-75130, in Context7 through version 2.1.2, scoring 9.0 on the CVSS scale. The flaw allows unsanitized content delivered through the MCP server to redirect connected AI coding agents. No vendor fix has been documented, leaving enterprises without a standard patch path.

Research2026-09-05

Microsoft: Agentic Security Requires Tool-Layer Controls, Not Just Model Guardrails

Microsoft's Security Blog published guidance on June 30, 2026, arguing that security controls for AI agents must be applied at the tool layer rather than relying solely on model-level guardrails. The guidance covers allowlisting MCP publishers, inspecting tool metadata, applying data loss prevention at the tool call parameter level, and correlating telemetry across agent actions. It directly implicates third-party risk programs, DLP frameworks, and agent audit trail requirements.