MCPSafe.io
RegistryThreatsMethodologyDocsPricingScanSign in
MCPSafe.io

Security checks for MCP servers — public packages and private repos, fast or deep.

Legal

Privacy PolicyCookie PolicyTerms of ServiceSecurity disclosure

Resources

State of MCP SecuritySupportSystem statusMade in Germany 🇩🇪

© 2026 MCPSafe. All rights reserved.

GDPR — Privacy Policy
← Threat Catalog

Interaction & Data Flow

Tool description exceeds context-budget cap

MEDIUMCWE: CWE-770Rule: MCP-252

An MCP tool's description is multi-thousand-token boilerplate — every tool listing burns LLM context, can crowd out other tools, and dilutes the model's ability to choose the right tool. Tool-listing variant of the unbounded-cost family; compute/memory is MCP-110, paid-LLM API is MCP-084, MCP sampling is MCP-211.

What it is

MCP clients send `tools/list` results into the model's context. A 5,000-token tool description gets paid for on every model call, even when that tool isn't selected. Worse, when many tools have bloated descriptions, the model's selection signal degrades — it can't tell which tool fits because they all use the same vocabulary at length.

Why it matters for MCP

Tool description is the only documentation the model sees. There's a temptation to put everything there: examples, edge cases, gotchas, link to docs. Resist. Describe the tool in 1-2 sentences and put the rest in the `inputSchema` description fields and external docs. The token budget is real money.

Vulnerable example

example.py
1
@server.tool(description="""
2
This tool sends an email to a user. It supports the following features:
3
- HTML and plain-text bodies
4
- CC and BCC recipients
5
- File attachments up to 10MB
6
- Multiple recipients (up to 50)
7
- Custom Reply-To
8
- Tracking pixels (opt-in)
9
- ... [hundreds more lines of description] ...
10
""")
11
def send_email(to: str, subject: str, body: str) -> str:
12
    ...

Secure example

example.py
1
@server.tool(description="Send a transactional email. See readme.md for advanced features.")
2
def send_email(
3
    to: str,
4
    subject: str,
5
    body: str,
6
    cc: list[str] = [],
7
    attachments: list[Attachment] = [],
8
) -> str:
9
    ...

How MCPSafe detects this

MCPSafe flags tool registrations where the `description` argument exceeds a token-budget cap (default 200 tokens, configurable). Long descriptions can either be migrated into `inputSchema` field-level descriptions or external readme links.

See the full threat catalog for every documented detection.

Further reading

  • CWE-770: Allocation of Resources Without Limits
  • MCP Spec — Tool description

Scan an MCP server for this issue

MCPSafe runs this check — and every other rule in the catalog — on any MCP server you paste in.

Scan now