The official MCP Registry is basically a flat list. No verification metadata, no attestation chain. If someone gets a malicious server listed there, Unicode tricks in tool descriptions are almost beside the point. Your agents are already pulling definitions from an unvetted source.
I have been tracking the IETF drafts that try to solve agent discovery and registration. There are about 11 competing ones (ARDP, AID, AINS, agents.txt, etc). Six expired or are expiring this month, no renewals filed. The ones still alive do not include any mechanism for cryptographic verification of tool descriptions.
At 500 agents, the question stops being "is this tool description clean" and becomes "should my agent be talking to this server at all." The sanitization work matters, but it is downstream of a trust problem that is currently wide open.
The 11 competing IETF drafts is a good data point. We looked at the same fragmentation from the A2A side in our paper on Google's Agent2Agent protocol. Six structural gaps in the v1.0 spec, including no authorization model at all. Each agent is an authorization island.
Our take is that protocol-level trust verification and tool-level sanitization are both necessary. Neither is sufficient alone. The trust layer tells you whether to connect. The sanitization layer tells you whether the content is clean after you've decided to connect. Attackers compromise trusted sources too.
This is a reason why we made our http framework (@outputai/http) a first class citizen for the greater framework and our claude code plugins.
As you pointed out at this moment in time theres a Cambrian explosion both in new tools/libraries and the willingness to use them, which poses a systemic security threat when combined with how LLMs function.
So while you're free to use any third party tool or library you want with Output. We encourage you to roll your own as often as possible both for the security/control it gives you. But also for the vertical integration it provides (debugging, cost tracking, evals etc...)
The most relevant to what you're asking about is "Invisible Ink" (invisible Unicode smuggling in MCP tool descriptions, GPT-5.4 follows hidden instructions 100% of the time) and "Weaponized by Design" (census-scale analysis of 15,982 MCP servers, 137,070 findings). Both have full methodology and reproducibility details.
The scanner is open source if you want to test against your own stack: npx @agentsid/scanner