Tip: Validate MCP Tool Outputs Against a Schema Before Passing Them Downstream (NSA Guidance)

NSA·medium signal

The NSA's MCP security guidance is explicit that tool outputs should be validated against a schema before reaching any downstream component, alongside filtering outbound proxies, DLP, sandboxing, and output filtering. For builders, the actionable step is to stop treating MCP responses as trusted text: schema-check them so a poisoned tool result can't smuggle instructions or data into the next stage of the agent loop.