Unicode review
Invisible Unicode characters in MCP manifests
Find bidirectional controls and zero-width characters that can make MCP tool metadata render differently from its underlying text.
- Published
- Reading time
- 6 minutes
Rendered text is not always source order
Unicode bidirectional controls can change visual ordering without changing the underlying sequence consumed by a parser. Zero-width characters may separate tokens or hide distinctions that are difficult to notice in an editor or client summary.
In MCP metadata, review tool names, descriptions, schema titles and descriptions, commands, arguments, URLs, roots, and environment values. Evidence should identify the code point and location rather than merely saying text looks suspicious.
Detection is not intent classification
Some controls are legitimate in multilingual text. Their presence becomes more consequential in identifiers, commands, paths, and security-sensitive prose where visual review is expected to match machine interpretation.
Normalize only when the protocol and application permit it. Silently deleting characters can change semantics, signatures, or identifiers; show the original and an escaped representation instead.
Review with two views
Use a rendered view for human meaning and an escaped code-point view for exact source. Confirm that reviewers and the consuming client receive the same complete field. Reject unexpected controls in fields with an ASCII-only contract.
tryb recursively reprocesses MCP manifest strings through its Unicode checks. That bounded scan does not prove there are no confusables or semantic tricks beyond the implemented rules.
Frequently asked questions
Are all bidirectional controls malicious?
No. They support legitimate bidirectional writing. In commands, identifiers, and security-sensitive metadata they warrant explicit review because visual and logical order can differ.
Should I normalize an MCP manifest automatically?
Not blindly. Preserve the original, inspect code points, and apply field-specific validation. Normalization or deletion can alter meaning.