Skip to main content
MCP server exposes more context than necessary, disclosing sensitive session, user, or tool data.

​
How to resolve

Apply data classification tagging: Classify all inputs and retrieved data using sensitivity levels (e.g., Public, Internal, Confidential, Restricted). Restrict low-trust agents and tools from accessing context tagged as Confidential or Restricted. Enforce policies that prevent high-sensitivity fields from being forwarded to lower-trust recipients. Implement context sanitization and redaction: Scan and redact PII, secrets, tokens, and system identifiers before context is returned in tool responses or stored. Deploy automated classification pipelines that strip sensitive fields from payloads before they enter the LLM context. Enforce least-privilege data exposure: Return only the minimum data required for each tool response. Define per-tool response schemas that explicitly enumerate which fields may be included. Evaluate permissions per request, not per session, and apply deny-by-default access policies for unrecognized agents or scopes. Monitor and audit context sharing: Implement automated detection for unusually large response payloads or responses containing sensitive field patterns (API keys, credentials, internal identifiers). Log all context read/write events with agent ID and context ID, and integrate logs into SIEM for anomaly detection.

​
Risk

Governance/Compliance Context overexposure vulnerabilities violate multiple security standards:
  • OWASP Top 10 for LLM Applications (LLM02:2025 - Sensitive Information Disclosure): Enables unintended exposure of sensitive data through excessive context sharing with the model or downstream systems.
  • NIST AI RMF (GOVERN-1.5, MEASURE-2.7): Fails to implement adequate data governance and monitoring controls to prevent unnecessary data disclosure across AI system components.
  • ISO/IEC 42001 (Data Minimization and Privacy Controls): Violates data minimization principles by exposing more information than necessary for the intended purpose.
  • EU AI Act (Article 10): Violates data governance requirements by sharing data beyond what is necessary for the AI system’s intended function.
  • OWASP MCP Top 10 (MCP10:2025 - Context Injection & Over-Sharing): Enables unauthorized access to sensitive data through overly permissive context sharing in tool responses.
Security Context overexposure enables data leakage by providing the model, tools, or clients with more information than they need. When tool responses include sensitive fields such as database credentials, API keys, user PII, or internal system details, this data enters the LLM context where it can be extracted through prompt injection attacks, inadvertently included in user-facing responses, or forwarded to other tools. Large unfiltered payloads also increase the attack surface for indirect prompt injection, as injected instructions hidden in excessive response data are harder to detect.

​
Explanation

An MCP server returns, forwards, or exposes more context than necessary to the model, tools, clients, or downstream systems, causing unnecessary disclosure of sensitive session, user, or tool data. This occurs when responses include unfiltered payloads containing sensitive fields that exceed what the recipient needs to perform its function.

​
Specifications

Trigger
  • MCP server scan detects large payloads sent to external tools or responses that include sensitive fields beyond what is necessary for the tool’s declared function
Severity
  • HIGH
Applies to: MCP Server