MCP Tool Server Architecture Defines Dry-Run Previews and Prompt Injection Guards
A newly documented Model Context Protocol (MCP) server architecture establishes a deterministic 5-phase execution routine with two-phase mutation safeguards. External inputs are strictly isolated in XML untrusted content tags to neutralize prompt injection while executing dry-run previews before write actions.
Impact: Medium
Why it matters
Implement strict JSON contracts and dry-run preview steps to secure custom MCP agents against prompt injection and unintended API mutations.
TL;DR
- 01Enforce dry-run previews before allowing MCP tools to perform mutation operations on remote databases or CRMs.
- 02Encapsulate all external web content and API responses in <untrusted_external_content> XML blocks.
- 03Define explicit JSON Schema output contracts to prevent structural model hallucinations during tool calls.
Key facts
- Execution Protocol Phases
- 5 Phases (Validation, Grounding, Reasoning, Dry-Run, Output Verification)
- Data Isolation Boundary
- <untrusted_external_content> XML tags
- Default Operational Mode
- dry_run_preview
Hardened 5-Phase MCP Execution Protocol
To eliminate vulnerabilities in autonomous agents operating over MCP remote servers, the reference architecture mandates a 5-phase sequence:
1. Phase 1: Input Validation & Schema Sanitization: Validates parameters against strict JSON argument definitions. 2. Phase 2: Live Grounding: Queries connected remote_mcp and SQLite state repositories. 3. Phase 3: Deep Analytical Reasoning: Evaluates state under assigned reasoning budgets. 4. Phase 4: Two-Phase Mutation Safeguard: Requires explicit dry_run_preview generation before executing database updates or external write actions. 5. Phase 5: Output Schema Validation: Returns structured response payloads enforcing deterministic JSON contracts.
Prompt Injection Mitigation
All external data (scraped web pages, tickets, external API payloads) must be encapsulated inside explicit <untrusted_external_content> tags. Prompts explicitly instruct reasoning engines to strip embedded markdown images and treat enclosed strings strictly as passive data rather than actionable commands.
Try it in 2 minutes
# Python CLI trigger command for MCP dry-run execution
python grokbot/cli.py \
--skill-id GROK-SKILL-273 \
--target "Target Entity / Account" \
--action dry_run_previewpython
✓ When to use
- When building enterprise MCP servers that execute destructive or state-changing actions across production services.
✕ When NOT to use
- For read-only tools that do not interact with persistent databases, external messaging APIs, or filesystem state.
What to do today
- Update custom MCP server handlers to support dry_run_preview parameters.
- Wrap untrusted text inputs inside <untrusted_external_content> tags in system prompts.
Sources