feat(mcp): detect concealed Unicode in tool listings - #154

Closes #152.

Why this one is different from the rest of the MCP backlog

The fingerprint answers "did this server change what it advertises". It says nothing about a server that was hostile from the first listing anybody ever took. That trust-on-first-use gap has been raised twice in review and is real.

Concealed control characters are the exception, and the only reason this earns a separate signal: they need no baseline and no history. There is no legitimate reason for a tool description to carry a Unicode TAG block.

U+E0000 to U+E007F mirrors ASCII, so a whole second instruction can be written in it and render as an empty string:

clean description length          14
TAG-concealed description length  37   (renders identically to a human)

Research calls this an approval-view fidelity gap, and the phrase is exact: the human approving the tool reads one string, the model receives another. Recording what the model was handed rather than what a human was shown is this project's entire premise, and here the two demonstrably differ.

What it emits

proxy emits      : {'tag_block': 18}
survives ingest  : {'tag_block': 18}
on the event     : {'tag_block': 18}
no text leaked   : True

Counts per category. Never the text, never which tool. A finding that carries a concealed instruction has copied that instruction into the trail and forwarded it to a SIEM.

Categories: tag_block, zero_width (ZWSP, ZWNJ, ZWJ, BOM, soft hyphen), bidi_control.

Design decisions worth reviewing

Walks every string, not a field list. #103 settled that argument for the severity split and it applies identically here: an allowlist fails open on whatever the spec adds next. Tested against a property description nested in inputSchema and against _meta, both of which a named list would have missed.

Private Use Area is deliberately not a category. Icon fonts use it legitimately, and a category that cries wolf costs more than the one case it might catch. There's a test asserting it stays unflagged.

Attached on new as well as changed. Everything else in this module needs a prior. This does not, and a test pins that it fires on a server never seen before.

Omitted entirely when clean, so mcp_schema, the quietest event class in the trail, gains no field on a well-behaved server.

Not blocked by the freeze

core/diagnostics/mcp_schema.py is outside _RULESET_SOURCES. Ruleset fingerprint unchanged at 15846a0915769d4a, dogfood clock untouched.

The field is declared on ExternalIngestBody, because an undeclared field is dropped silently and that has already cost this file two shipped bugs. test_ingest_roundtrip.py would have caught it regardless, which is the point of having written it.

1,182 tests, ruff clean, benchmark 26/26 with 0 missed and 0 false positives.

🤖 Generated with Claude Code