OpenClaw scrubs MCP tool descriptions for prompt injection, and one of its three rules does nothing

Kind: nuance · Status: current · Last verified: 2026-08-26 · Clients: openclaw · Revisions: 2025-11-25

sanitizeMcpMetadataText is a 25-line function applied to tool.description as tools are materialized, on the agent surface and the node host both. It does three replacements and a truncation:

The third rule is a no-op on content. Its regex allows any run of whitespace between the two words, so the only thing it changes is casing and spacing — System Prompt becomes system prompt and nothing is redacted. Either it was meant to redact and does not, or it was meant to normalize and reads like a redaction next to the two rules above it.

The first two rules are exact-phrase matches, so any rephrasing walks past them. That is not a criticism of the intent so much as a limit worth recording: this is a marker for the obvious string, not a defence.

What the sanitizer covers is also narrower than it looks. It is applied to tool descriptions. Resource contents, prompt contents and tool names on the agent surface do not pass through it — the node host runs tool names through it, the agent bundle does not.

Recorded because it is the only client read so far that scrubs server metadata before showing it to a model at all. OpenClaw pairs it with two other trust boundaries: generated resource and prompt tools carry an explicit untrusted-output sentence in their descriptions, and under Tool Search no MCP tool name or description is copied into the system prompt in any mode.

Sources