Most of 19 audited MCP servers keep their context-injection surfaces out of the docs

An engineer asks a coding agent for the current syntax of a library call. The agent queries an MCP documentation server, gets text back, folds it into context, and carries on. That is the shape of the request that carried the Context7 flaw: according to the audit, a free-text "Custom AI Instructions" feature served through the MCP server let unsanitised content reach connected coding agents during what looked like a routine library-documentation lookup ^[9]. From the operator's chair, nothing in that exchange looks like an attack.

The spec gives you better vocabulary for this than most rollout checklists do. The 2026-07-28 revision defines three server primitives with a control hierarchy attached: prompts are user-controlled to invoke, resources are application-controlled, tools are model-controlled ^[15]. Read those definitions closely and there are seven separate routes by which server-originated text can reach a model's context ^[16]. The census turns three of them into questions a reviewer can actually ask a vendor page: is there a server-level instructions field, is there a free-text instruction surface someone can configure, and does the vendor warn that tool output may carry embedded instructions ^[5].

Nineteen servers against three questions is 57 documentation cells ^[19], and the modal value in every column is undocumented ^[6]. Teams often assume they reviewed the MCP server because they read the tool list. But the tool list contains tool names and descriptions, which are one of several surfaces alongside the optional instructions field, resource content, prompt templates, and the tool results themselves ^[2].

The caveat carries more weight than the tally. Undocumented means the vendor's own public docs do not disclose the surface, not that the surface is absent from the running code, and only a code-level audit could separate the two ^[7]. A server that genuinely does not use an instructions field and a server that uses one silently land in the same cell. That is the authors' actual finding ^[4]. They call it a census rather than a ranking because a reviewer cannot evaluate a surface a vendor never mentions ^[6].

Severity travels badly here too. The same Context7 flaw sits 2.6 points apart depending on which CVSS framework you read ^[20], and as of the audit's retrieval date of 2026-08-22 the advisory documented no public fix, which the authors state as an absence of documentation rather than a claim about later releases ^[14].

The forcing function is cheap to run against whatever is already in your config. Score the three census questions from the vendor's documentation alone for each MCP server you have connected, and any cell you cannot resolve stays visible as a dated unknown rather than a guess ^[18]. Any server that returns silence on all three gets treated as though the answer to all three is yes: scoped credentials that cannot reach an environment file, and output a human reads before it becomes a file operation. The tradeoff is not hidden. You will over-restrict servers that were clean, and you will pay for it in manual steps the demo never had. The alternative is granting file and credential access on the strength of documentation that, by this census's count, mostly declines to say what it puts in your agent's context ^[3].