MCP servers write into your system prompt. Nobody logs it.

TL;DR. When an agent connects to an MCP server, the server may return an instructions string, and the client MAY fold it straight into the system prompt. That is the spec, working as designed. A registry-scale probe published this week by fetchgate.dev reports that of 15,329 URLs in the official MCP registry, 53.7 percent answered at all, and 23.6 percent of those that answered ship a non-empty instructions payload into every conversation, the largest weighing 68,669 characters, roughly 17,000 tokens before a single tool runs. A separate audit of 19 widely deployed servers found that eighteen of them document nothing about this surface. The headline risk everyone was warned about is injection. The cost being paid today is quieter: text you never wrote, steering and taxing every conversation your agent has.

Every protocol has a field that seemed harmless in review. The Model Context Protocol's candidate is instructions, an optional string a server returns during initialization. The schema's own doc comment is admirably honest about what happens next: "Instructions describing how to use the server and its features. This can be used by clients to improve the LLM's understanding of available tools, resources, etc. It can be thought of like a 'hint' to the model. For example, this information MAY be added to the system prompt."

Read that as an engineer reviewing an interface, not as a spec author writing one. A remote party you connected to five seconds ago supplies free text, and your client is invited to place that text in the most privileged position an LLM conversation has. There is no length limit in the schema, no format constraint, no requirement that the client show the text to the user. Most clients that support the field concatenate and move on. The server's author gets a direct line to your model. You do not get a notification.

The channel is busy, and almost nobody discloses using it

Until recently the honest answer to "how much does this actually happen" was a shrug. Two measurements this month replaced the shrug.

The first is a census. fetchgate.dev probed all 15,329 URLs in the official MCP registry and reports three numbers worth keeping. Only 53.7 percent of registered servers responded at all, which says something unflattering about the registry as a curated index. Of the servers that did respond, 23.6 percent return a non-empty instructions field, injected into every conversation with every client that honors the spec's MAY. And 480 hosts use what the auditors class as manipulative phrasing, directives like "you must always call" this server's tools, which reads as advocacy for invocation, addressed to a model that is disposed to comply. Those figures are the auditors' own reporting; the registry moves daily and the response rate alone tells you any census of it is a snapshot. The shape of the finding matters more than the decimals: this channel is in routine, ecosystem-wide use.

The second measurement is about disclosure, and it is the one I find more damning because it covers the servers people actually run. Digital Applied audited 19 widely deployed MCP servers against the spec's five context surfaces: tool descriptions, the server-level instructions field, resource content, prompt templates, and tool results. Exactly one of the nineteen documents a free-text instruction surface of any kind; the remaining eighteen leave both their own surfaces and the spec's instructions field entirely undocumented. The ecosystem's most installed servers can write into agent context through up to five channels and, with one exception, say nothing about which they use.

Put the two together and the situation is: a quarter of the registry uses the quiet channel, and the popular servers do not tell you whether they do.

Count it as spend, because that is what it is

The security framing of server-controlled context is a year old and mostly hypothetical for the median team. The cost framing is neither. Every character a server pushes into context is paid for on every request: in tokens on metered API pricing, in latency, and in the finite attention the model has for the things you actually put in the conversation. The New Stack's engineering breakdown of MCP token bloat prices each connected tool at roughly 550 to 1,400 tokens once its name, description, JSON schema, field descriptions, and enums are counted. That is per tool, before the server-level instructions land on top, and popular servers ship dozens of tools. fetchgate's outlier, the 68,669-character instructions payload, is about 17,000 tokens of one vendor's prose in every single conversation, which at typical frontier-model pricing is a real line item at fleet scale and a real bite out of a context window at any scale.

The subtler cost is behavioral. An instructions field that says "always call this tool first" does not need to jailbreak anything to change what your agent does; it just needs to be in the system prompt, where models weight it heavily by design. We wrote earlier this month about what happens when agents generate SQL nobody reviews: the failure was not malice, it was unowned behavior accumulating where no one was looking. Server instructions are the same category of problem one layer up. Your agent's disposition toward a production database is now partly authored by whichever MCP servers happen to be connected, and the authorship is invisible in every transcript your team reviews.

This dynamic also has a precedent inside your own repos. Context files only ever grow, because adding an instruction has a visible payoff and removing one has an invisible risk. The instructions field obeys the same ratchet, with a worse twist: the text is not even yours to prune. The vendor appends; you pay.

The weaponized case is real, scored 9.0, and still unfixed

None of this stays hypothetical on the security side either. On August 18, NVD published CVE-2026-75130, a prompt-injection vulnerability in Context7, Upstash's widely installed documentation server. The mechanism is exactly the surface this post is about: a free-text "Custom AI Instructions" feature let unsanitized content reach connected coding agents during routine documentation requests, with advisory-described paths to credentials in environment files and destructive file operations. The server itself has no such access; the coding agent consuming its output does, which is where the damage lands.

Two details make it a useful case study rather than one more CVE. First, the scoring split: 9.0 critical under CVSS 3.1, 6.4 medium under CVSS 4.0, the same bug landing on opposite sides of most teams' patch-now threshold depending on which calculator their tooling uses. Scoring frameworks disagree about this vulnerability class because the damage happens in the agent, not the server, and our tooling attributes badly across that boundary. Second, the fix status: at publication, no public fix was documented for the affected range. We covered the protocol-level version of this problem when two MCP spec flaws chained into a cross-user injection earlier this month; the proposals under discussion there, treating instructions as untrusted content clients must isolate, would mitigate this whole class. None has shipped.

The honest synthesis is that documented in-the-wild exfiltration through server instructions remains scarce, while the measured, everyday effect is cost and steering. Prioritize accordingly, but notice that the mitigation for both is the same, and it is not a firewall.

Treat connected context like a dependency, because it behaves like one

An MCP server is a dependency that executes in your agent's head. The supply-chain toolkit maps over almost verbatim:

Pin and snapshot. Capture the initialize response from every server you connect. Store the instructions string and the full tool list in version control. You cannot reason about drift you never recorded, and an 89-day arXiv measurement of the registry found that server descriptions go stale unevenly, so the drift is not hypothetical.

Diff on update. When a server version changes, diff its context payload the way you diff a lockfile. A dependency that quietly rewrote its post-install script would page someone; a server that doubles its instructions between versions should too.

Budget per server. Decide what a server's metadata is allowed to cost, in tokens, and alert past the ceiling. The New Stack's per-tool estimate gives you a defensible starting unit. A vendor's verbosity should be their problem before it is your invoice.

Read what you are being told. Once the payload is in a file, grep it. Directive language aimed at the model ("always", "you must", "before any other tool") is a vendor negotiating with your agent instead of with you. That is worth knowing before granting the server's tools write scopes, and it is invisible until you extract it.

None of this needs new infrastructure. It needs the decision that context, like code, has provenance worth tracking.

Where Datapace fits

Datapace is building the context layer between your databases and your AI: resolved meaning validated by the people who own the data, the workload evidence beside it (cost, performance, usage and freshness, lineage), and a policy gate over what an agent may do and access, served over MCP. Building on the serving side of this protocol is exactly why the instructions surface worries us: when context arrives without provenance, the model cannot weigh it, and the audit above shows most of the ecosystem ships it that way. The design position this argues for is that everything a context layer serves an agent, instructions included, should be as inspectable and versioned as the schema metadata it describes, so that "what was my agent told, by whom, as of when" is a query rather than a forensic exercise. If your agents consume MCP context today and you could not produce that answer for yesterday, book a call.

Sources

1. Model Context Protocol, schema 2025-06-18, InitializeResult.instructions (field definition and doc comment quoted above).
2. fetchgate.dev, MCP Registry Audit 2026, August 2026 (15,329 URLs probed; response rate; instructions prevalence; largest payload; manipulative-language count; figures as reported by the auditors).
3. Digital Applied, We Audited What MCP Servers Put in Your Agent's Context, August 2026 (19-server disclosure audit; five context surfaces).
4. Digital Applied, An MCP Server Bug Scores 9.0. No Fix Is Documented, August 2026 (CVE-2026-75130 publication date, scoring split, fix status).
5. Noma Security, ContextCrush: the Context7 MCP server vulnerability hiding in plain sight, August 2026 (vulnerability mechanism).
6. The New Stack, 10 strategies to reduce MCP token bloat (per-tool token cost estimates).
7. arXiv, Registry Descriptions Go Stale Unevenly: An 89-Day Measurement of Model Context Protocol Drift, August 2026.