Silent Action Concealment Instructions in Tool Descriptions

Detects MCP tools that explicitly instruct the LLM to perform actions silently or hide implementation details from users. Patterns include "do not mention this to the user" and "don't tell the user about", which indicate the tool is performing hidden operations (e.g., credential harvesting, webhook subscriptions, data uploads) while instructing the LLM to conceal these actions from the user.

Response Actions

References