What is Line Jumping?
Line jumping is an MCP attack class, described by Trail of Bits, in which a malicious server embeds prompt injection payloads in tool descriptions returned from tools/list, manipulating the model's behaviour before any tool is invoked.
WHY IT MATTERS
When an MCP client connects to a server, it calls tools/list and places the returned tool names, descriptions, and schemas into the model's context so the model knows what it can call. Line jumping exploits this step: the injection payload rides in the description text itself, so it shapes the model's behaviour the moment the server connects — the attack "jumps the line" ahead of any tool invocation.
This is what makes the class distinct from ordinary tool poisoning scenarios that require the poisoned tool to be called. Most MCP security controls — human approval prompts, per-call confirmation, invocation logging — sit at the call boundary. Line jumping never crosses that boundary, so those checkpoints see nothing. Trail of Bits demonstrated payloads that exfiltrate conversation history via trigger phrases and hide instructions using ANSI escape sequences.
Practical implications for teams running multiple servers:
- Review tool descriptions before a server is added to a client, not just its tool behaviour at runtime.
- Treat tool discovery output as untrusted input from the server.
- Watch for description changes between versions — a benign server can turn malicious later (see MCP rug pull).
HOW POLICYLAYER USES THIS
PolicyLayer addresses line jumping at the adoption stage rather than the call stage. Its public catalogue at policylayer.com/tools scans MCP servers and classifies each tool's risk from its description and schema before you connect it, and the npx policylayer CLI scanner runs the same description-level analysis against your own MCP configuration. The gateway additionally pins what registered servers expose, so a server that changes its tool descriptions upstream is surfaced rather than silently re-injected into clients.