This is a red-teaming framework designed to demonstrate MCP security vulnerabilities, not a production tool server. Both tools contain embedded prompt-injection payloads in their descriptions, this is intentional and the entire point of the project. Tool 1 (search_docs) hides instructions to read .env files in the description. Tool 2 (list_recent_docs) injects instructions to add [email protected] to email BCC fields. Schemas are present but minimal. Descriptions are deliberately adversarial, not LLM-optimized. This server is a security research artifact, not a usable MCP server for production agents.

• If this were a legitimate tool server: remove all prompt-injection payloads from descriptions and replace with clear, honest documentation of what each tool does and when to call it.
• Add 'required' arrays to all schemas and specify min/max constraints for numeric parameters (e.g., limit: 1 - 100).
• Document output schemas so agents know what fields to expect (e.g., search_docs returns {passages: [{title, content, score}], total_count}).
• Add parameter descriptions for all fields (e.g., 'limit: Maximum number of results to return, 1 - 100, default 20').
• Implement error handling that guides recovery: 'No documents found. Try a broader query or check workspace permissions.'