Thanks Kevin. Same scan per string. A JSON array of records is walked like any other result: each title, headline and description is scored on its own, the same way a Jira comment is. If the tool returns that JSON as one text blob, it is parsed first and then each inner string is scanned. A clean string stays byte for byte.
A short field is not scored differently. A headline that says "ignore previous instructions" is withheld the same as that sentence in a long ticket. A job title or company name usually passes, because the rules look for instruction-shaped text. One poisoned field is replaced with a quarantine notice; the rest of that row and the other rows still come through.
The one-line rule you put in the prompt is the right idea. The hook applies it to the tool result, so it does not depend on the model remembering it. It keeps the instruction out of what the model reads. It does not freeze the next tool call. If this database server's name is not one the hook already treats as outside, set it untrusted in ~/.mcp-warden/config.toml, or those rows are left alone.
For further actions, you may consider blocking this person and/or reporting abuse
We're a place where coders share, stay up-to-date and grow their careers.
Thanks Kevin. Same scan per string. A JSON array of records is walked like any other result: each title, headline and description is scored on its own, the same way a Jira comment is. If the tool returns that JSON as one text blob, it is parsed first and then each inner string is scanned. A clean string stays byte for byte.
A short field is not scored differently. A headline that says "ignore previous instructions" is withheld the same as that sentence in a long ticket. A job title or company name usually passes, because the rules look for instruction-shaped text. One poisoned field is replaced with a quarantine notice; the rest of that row and the other rows still come through.
The one-line rule you put in the prompt is the right idea. The hook applies it to the tool result, so it does not depend on the model remembering it. It keeps the instruction out of what the model reads. It does not freeze the next tool call. If this database server's name is not one the hook already treats as outside, set it untrusted in ~/.mcp-warden/config.toml, or those rows are left alone.