Skills
Microsoft MCP Two-Barrier Indirect Prompt Injection Defense: Request Sanitization Gateway + Response Filtering with Explicit Tool Approval
Microsoft's developer blog documents a two-barrier MCP injection defense: the first barrier sanitizes all incoming requests by enforcing strict templates that separate user content from server-injected instructions, and the second barrier filters LLM responses by stripping instruction-like phrases and requiring explicit user approval before any tool execution fires. The pattern recommends running this logic in an MCP gateway proxy layer that sits between the client and server, intercepting traffic before it reaches the agent. Combined with least-privilege tool permissions and context isolation that blocks access to conversation history, this forms a four-layer defense-in-depth for production MCP deployments.
↳ Follow the thread