MCP Line Jumping — Agent-Directed Imperative Embedded in a Tool/Parameter Description Field (Pre-Invocation Injection) - ATR-2026-00579 (164e9fea-5134-5340-8eb6-b318a79b3f2c)
Detects the MCP "line jumping" attack class (The Vulnerable MCP Project entry line-jumping-attack, reported by Trail of Bits). A malicious MCP server smuggles instructions aimed at the model INTO A TOOL-SCHEMA OR PARAMETER DESCRIPTION FIELD. Because MCP clients load every tool description into the model's context the moment a server is listed, the injected instruction executes BEFORE the tool is ever invoked — jumping the line ahead of user approval of any tool call. The detectable signature is a tool/parameter schema "description" field whose value carries an agent-addressed pre-invocation imperative: telling the assistant/model what it MUST do (prepend a command, route output, ignore the user) before or whenever it calls a tool. This is distinct from a conversation-level "ignore previous instructions" (the directive must live inside a tool-schema description field) and from the rug-pull class (no temporal redefinition trigger) and the