Why Prompt Injection Hits Harder in MCP: Scope Constraints and Blast Radius

Why Prompt Injection Hits Harder in MCP: Scope Constraints and Blast Radius The GitHub issue tracker for the official MCP servers repository has developed a recurring theme over the last two months: security advisories. Not general hardening suggestions — specific reports of prompt-injection-driven file reads, SSRF, sandbox bypasses, and unconstrained string parameters across official servers. This is not a bug-report backlog. It's a design pattern gap. The reason prompt injection hits harder in MCP than in stateless APIs isn't just "LLMs can be tricked." It's that MCP tools are action-capable by design, and most server implementations give those tools unconstrained reach into the environment they run in. The structural problem: tools with no scope constraints A traditional API call is scoped by default. The credential you provide determines what you can touch. Rate limits bound how much. The request schema constrains the surface. An MCP tool call is different. The tool's action bounda