Filter tool outputs for instruction-like phrases before they re-enter the model — the second barrier most agents skip

Obot AI·medium signal

Most MCP defenses harden the input side, but injected instructions usually arrive inside tool results. Response filtering strips imperative/instruction-like phrasing from LLM and tool outputs before they're fed back, acting as a second barrier behind input sanitization, and pairs with explicit user approval for any tool execution. It's a cheap middleware layer that catches indirect injection the input filter never sees.