MCP Registry Testing Exposes Hidden System Prompts: More Than 5,000 Reachable Servers Return Instructions

Fetchgate sent `initialize`, `notifications/initialized`, and `tools/list` requests to each of the 15,329 remote URLs listed in the official MCP Registry, without invoking any tools. A total of 8,235 endpoints successfully returned tool lists containing 140,284 tools, and 5,462 of those endpoints also included non-empty `instructions` in their handshake responses. The MCP specification defines this field as a natural-language hint that helps the model use the server and allows clients to include it in the system prompt, but it imposes no length limit and does not require interfaces to disclose it to users.

In the tests, the median `instructions` length was 577 characters. At 114 endpoints, it exceeded 5,000 characters, while the longest reached 68,669 characters—roughly estimated to consume about 17,000 tokens before each conversation even begins. Tool descriptions showed similar bloat: 9,262 exceeded 1,500 characters, and one `create_diagram` description reached 52,183 characters. If this content is resent with every request, it not only increases cost and latency but may also dilute the weight of the user prompt and prior conversation within a limited context window.

More sensitive still was behavior-shaping language. Researchers manually identified 47 endpoints that instructed models not to disclose information about certain platforms, competitors, failures, or security blocks to users. On 480 hosts, the text used model-directed phrases such as “you must” or “always call,” while 406 claimed that their tools should run before other tools. This does not necessarily amount to malicious prompt injection: the study found no textbook-style instructions to steal keys among the 140,284 descriptions, and some of the text merely specified internal identifiers or payment-flow rules. Nevertheless, it demonstrates that server providers can alter agent behavior outside the ordinary chat history.

Platform engineers should preserve the instructions and tool descriptions obtained during each handshake, perform version diffs, enforce token budgets, and audit provenance as they would when locking dependencies. They should also treat annotations such as `readOnlyHint` as server self-attestations rather than proof of authorization. The data remains subject to bias: the URLs include historical versions, 3,617 endpoints requiring authentication could not be inspected, and two providers accounted for nearly 30% of successful endpoints. This is a snapshot from one point in time and one network location—not a measure of the maliciousness rate across the entire MCP ecosystem.