A paper shows you can harden MCP servers without touching their code.

SPELLSMITH finds taint-style flaws, untrusted input reaching dangerous sinks, make up a large share of MCP-server CVEs, are slow to get patched, and need big code changes to fix (arXiv). Its move is to rewrite tool descriptions to be security-aware so the model avoids triggering the vulnerable path, no server change required. The lesson that sticks: tool descriptions are a real security surface, not documentation.