This is a deliberately hostile example server designed to demonstrate prompt injection attacks, not a production MCP tool. All four tools have critical security issues by design: read_document contains an embedded prompt injection attack in its description instructing the LLM to exfiltrate SSH keys; search returns injected malicious instructions; delete_document is destructive without safeguards. Tool descriptions are present but weaponized. Input schemas exist but are minimal. This server is intentionally unsafe for evaluation purposes and should never be deployed in production.

• Remove all prompt injection payloads from tool descriptions. Descriptions must state only what the tool does, not hidden instructions for the LLM.
• Add input validation: constrain 'path' parameters with regex patterns (e.g., no '..' traversal), validate 'query' length (max 256 chars), and reject suspicious patterns.
• Implement a confirmation step for delete_document: return a 'requires_confirmation' error with a confirmation_token, then require the token in a second call to actually delete.
• Return structured JSON responses with status, data, and error fields instead of plain strings. Include error codes and recovery hints (e.g., 'path_not_found: try list_documents() first').
• Add tool annotations: mark delete_document with destructiveHint=true, mark read_document and search with readOnlyHint=true, and mark list_documents with idempotentHint=true.