MCP server prototype chain manipulation security

How prototype pollution works in MCP tools

A prototype pollution attack requires three conditions to be simultaneously true:

1. Attacker-controlled JSON is parsed into an object (tool arguments, fetched API response, uploaded file)
2. That object is merged into another object using a recursive merge function that doesn't sanitize keys
3. The resulting polluted property is then checked somewhere in the codebase with an obj.property access pattern that falls through to the prototype chain

The classic lodash merge attack:

// Tool receives this as the args object (parsed from JSON):
const maliciousArgs = JSON.parse('{"__proto__": {"isAdmin": true}}');

// Any code that calls JSON.parse on {"__proto__": ...} gets a plain object
// But it has a key literally named "__proto__" that lodash.merge will follow:
import _ from 'lodash';

const defaults = { theme: 'dark', pageSize: 20 };
const merged = _.merge({}, defaults, maliciousArgs);
// ^ lodash traverses "__proto__" key and sets Object.prototype.isAdmin = true

// Now in EVERY subsequent check in this process:
const user = { name: 'alice', role: 'viewer' };
console.log(user.isAdmin); // true — inherited from Object.prototype!

Vulnerable merge patterns in MCP server code

Mitigation 1 — use secure-json-parse for untrusted JSON

import sjp from 'secure-json-parse';

// Throws if the JSON contains __proto__, constructor, or prototype keys
const safeArgs = sjp.parse(rawInput);

// For tool argument processing:
function parseToolArgs(raw) {
  try {
    return sjp.parse(raw, null, { protoAction: 'error', constructorAction: 'error' });
  } catch (err) {
    throw new Error('Invalid argument structure: prototype manipulation detected');
  }
}

Mitigation 2 — safe deep merge without prototype traversal

// Safe recursive merge that skips prototype-polluting keys
function safeMerge(target, source) {
  if (typeof source !== 'object' || source === null) return source;

  const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
  const result = Array.isArray(source) ? [] : Object.create(null);

  for (const key of Object.keys(source)) {
    if (FORBIDDEN_KEYS.has(key)) continue;  // skip entirely

    const val = source[key];
    if (typeof val === 'object' && val !== null && !Array.isArray(val)) {
      result[key] = safeMerge(target?.[key] ?? Object.create(null), val);
    } else {
      result[key] = val;
    }
  }
  return result;
}

// Or use lodash.mergeWith with a customizer to block forbidden keys:
import _ from 'lodash';

function safeLodashMerge(target, source) {
  const FORBIDDEN = new Set(['__proto__', 'constructor', 'prototype']);
  return _.mergeWith({}, target, source, (objVal, srcVal, key) => {
    if (FORBIDDEN.has(key)) return objVal; // keep original, discard source
    return undefined; // let lodash handle it normally
  });
}

Mitigation 3 — Object.freeze(Object.prototype)

The most robust defense is to freeze Object.prototype at process startup. Once frozen, any attempt to add a property to Object.prototype throws a TypeError in strict mode or silently fails in non-strict mode. Neither pollutes the prototype.

// Add at the VERY TOP of your server entry point — before any other imports
// (in the first module that Node.js evaluates)
Object.freeze(Object.prototype);
Object.freeze(Object.prototype.constructor);

// Verify it works:
try {
  Object.prototype.isAdmin = true;
} catch (err) {
  console.log('Prototype pollution attempt blocked:', err.message);
  // TypeError: Cannot add property isAdmin, object is not extensible
}

// Also freeze Function.prototype to prevent constructor-chain attacks
Object.freeze(Function.prototype);

Mitigation 4 — null-prototype objects for config stores

For configuration stores, option objects, and key-value registries that you control (not from untrusted input), create them with Object.create(null) rather than {}. These objects have no prototype chain — obj.hasOwnProperty doesn't exist, and pollution of Object.prototype doesn't affect them.

// Config store with no prototype — immune to pollution effects
const config = Object.create(null);
config.maxRetries = 3;
config.timeout = 10_000;

// Access patterns that work with null-prototype objects:
const val = config['maxRetries'];        // OK
const has = Object.prototype.hasOwnProperty.call(config, 'key');  // use this form
const keys = Object.keys(config);        // OK

Detecting prototype pollution in test suites

// Add to your test suite: verify no test mutates Object.prototype
beforeEach(() => {
  const snapshot = Object.keys(Object.prototype).join(',');
  // @ts-ignore
  global.__protoSnapshot = snapshot;
});

afterEach(() => {
  const current = Object.keys(Object.prototype).join(',');
  // @ts-ignore
  expect(current).toBe(global.__protoSnapshot);
  // If this fails, a test (or the code under test) polluted Object.prototype
});

SkillAudit findings for prototype chain manipulation

Related references: memory exhaustion security · prompt injection defense · zero-trust MCP architecture