Split planning from execution to shrink prompt-injection blast radius in MCP agents

Practical DevSecOps·high signal

An emerging MCP defense separates the model's planning and execution roles: a 'planner' decides which tools to call while a separate, tightly constrained 'executor' performs the actual invocations. Because the executor can't be talked into new actions by injected text, a successful injection can't expand beyond the pre-authorized plan. Pair it with response filtering that strips instruction-like phrases from tool outputs as a second barrier.