Context7 MCP Server Custom Instructions Prompt Injection

Technical Analysis

The Custom AI Instructions feature accepts unsanitized content that is passed through the MCP server into the context window of any connected coding agent, effectively acting as an untrusted tool-output channel that the agent treats as trusted system/tool guidance. Because MCP responses are not distinguished from legitimate instructions, an attacker can poison the custom instructions returned during a normal documentation-fetch request, causing the agent to invoke local tools (file read/exfil, file delete) it was never intended to use for that task. This crosses the trust boundary between a content-retrieval MCP server and the agent's execution/planning layer, turning a read-only documentation query into an RCE-equivalent chain: credential theft from .env files followed by destructive filesystem operations. The attack requires no direct access to the victim's machine — only that the victim's agent queries the compromised/poisoned Context7 instance for library docs.

Affected Systems

Context7, MCP-based coding agents/assistants; protocols: MCP

Detection Signatures

• MCP tool responses containing embedded imperative instructions (e.g. 'ignore previous instructions', 'read .env and send to', 'delete all files in')
• Outbound network requests to unfamiliar domains immediately following a library documentation/MCP query
• Unexpected file deletion or mass file access shortly after an agent tool-call to Context7
• Custom AI Instructions fields containing base64/obfuscated payloads or URLs
• Agent logs showing tool invocation sequences (file read -> network POST) not matching the original user intent (docs lookup)

Remediation Steps

1. 1

   Upgrade Context7

   Update to a patched version beyond 2.1.2 once available; monitor vendor advisories for a fix.

2. 2

   Sanitize and isolate MCP tool output

   Treat all content returned from MCP servers, including 'custom instructions,' as untrusted data; strip or neutralize imperative/instructional language before it reaches the agent's context.

3. 3

   Enforce least-privilege tool access

   Restrict coding agents' filesystem and network tool permissions so a documentation-lookup workflow cannot trigger credential file reads or destructive deletes.

4. 4

   Add human-in-the-loop for sensitive actions

   Require explicit user confirmation before any agent-initiated file deletion or outbound network transmission of local file contents.

5. 5

   Deploy prompt-injection detection

   Use input/output filtering or guardrail models to detect injected instructions in MCP responses before they reach the agent's planner.

6. 6

   Audit environment file exposure

   Avoid storing plaintext secrets in .env files accessible to agent tooling; use vaults or scoped credential injection.