Line jumping
An MCP server influencing a model's behavior via its tool descriptions before any tool is invoked and before the user approves anything.
MCP's security model leans on the user approving each tool call. Line jumping points out that the tool descriptions are already in the model's context the moment the server connects — so a server can shape the model's actions (or plant instructions to exfiltrate data through other tools) without ever having one of its own tools approved. It has "jumped the line" past the checkpoint.
Why it matters
It shows the approval-at-invocation design is incomplete: the review needs to happen when descriptions are loaded, not just when tools are run. Clients that only gate execution are protecting the wrong step.
Real-world context
Named by Trail of Bits on 21 April 2025 in "Jumping the line: How MCP servers can attack you before you ever use them," analysing how tool descriptions bypass MCP's invocation-time approval model.
Exposure map
Live counts of instances showing this pattern will appear here once the exposure map is collecting data.