MCP Server Audit Finds Context Injection Across 19 Servers, Including Active Prompt Injection in Context7
What happened
Digital Applied published We Audited What 19 MCP Servers Put in Your Agent's Context, a first-party empirical review examining how MCP servers deliver content into agent context windows and whether that content includes unexpected or adversarial instructions. Across 19 servers reviewed, the audit found that tool outputs frequently include material beyond the declared function of the server, including content capable of redirecting agent behavior. A specific prompt injection vulnerability was disclosed in Context7, a widely used MCP server for documentation retrieval. The audit follows a pattern of MCP-specific disclosures that have accumulated throughout 2026, including 91.8% of audited MCP servers lacking OAuth controls and active exploitation findings from NIST's DNS rebinding flag on MCP servers. The core finding is that MCP servers represent an untrusted data source injected at a privileged position in agent workflows, and current enterprise onboarding processes do not treat them as such.
Why it matters
- ·Context injection through MCP servers bypasses agent permission boundaries and prompt injection defenses that enterprises have implemented at the model layer, meaning tool-level controls are the missing piece and existing security architecture does not compensate for absent server-side vetting.
- ·Any agent workflow that relies on MCP tool outputs without adversarial pre-testing is operating with an unverified input surface; in regulated industries, this creates traceability and accountability failures because the agent's reasoning and actions cannot be cleanly attributed when the context has been silently altered.
- ·The Context7 disclosure puts enterprises using that server on immediate notice of a confirmed injection path, but the broader finding -- that unexpected context is a common MCP server behavior rather than an exception -- means the vendor due diligence obligation extends to every MCP server in the agent toolchain, not just one.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Compile a complete inventory of every MCP server currently connected to agent workflows, including those introduced by individual teams or developers without formal approval.
- ☐Pause or isolate any agent workflows using Context7 pending review of the disclosed prompt injection issue and confirmation that a patched or mitigated version is in use.
- ☐Establish a pre-onboarding review gate for MCP servers that includes adversarial context inspection: feed test prompts through the server and examine the full context returned to the agent before approving the integration.
- ☐Update vendor due diligence questionnaires and contractual requirements to cover MCP server behavior, including disclosure obligations for any server-side instructions injected into agent context.
- ☐Add MCP server outputs to the scope of your agent action audit trail so that injected context is logged alongside agent decisions, enabling post-incident forensic reconstruction.
What to watch next
Compliance teams should monitor whether the Context7 maintainers publish a formal patch and security advisory, and track whether other widely used MCP servers named in the Digital Applied audit receive similar disclosures in follow-on research. The accumulation of MCP-specific findings in 2026 -- spanning OAuth gaps, DNS rebinding, ANSI escape injection, and now context injection at scale -- signals that standards bodies and regulators may move toward formal MCP server security requirements; teams should watch the OWASP Top 10 for Large Language Model Applications update cycle and the MCP project's own sandboxing baseline for enforceable guidance. Enterprises that have signed onto voluntary AI safety commitments should also assess whether their current MCP posture is consistent with the tool integrity expectations embedded in those frameworks.