MCP Colors is a security model that tags every AI agent tool as red (untrusted content) or blue (critical action) and forbids any single agent from holding both colors in one session.
Source: Concept derived from Simon Willison's Lethal Trifecta. Enforcement described here ships in Prismor (https://prismor.dev).
MCP Colors constrains what a prompt-injected AI agent can accomplish instead of trying to detect the injection. It simplifies Simon Willison's three-property Lethal Trifecta (private data, untrusted content, external communication) into two labels because private data is assumed to be always present. Red marks tools that ingest untrusted content. Blue marks tools that take a critical action. A session that never mixes the two colors gives a prompt injection no path from instruction to consequence.
The model applies to Model Context Protocol (MCP) tools, coding agents, and any LLM agent that calls tools. It works for agents built on LangChain, CrewAI, the OpenAI Agents SDK, and raw MCP servers.
Prompt injection is not reliably detectable, and no current technique closes that gap. LLMs collapse the data plane and the control plane into one token stream, so instructions embedded in retrieved content carry the same weight as system instructions. Algorithmic injection attacks reach high success rates and transfer across model families. The practical response is containment: limit what an injected agent can reach, not catch the attacker.
- Red (untrusted content): tools that pull in data an attacker could control. Examples: web search, reading a PDF from a prospect, fetching an email, querying an internet-sourced database.
- Blue (critical actions): tools whose misuse is costly. Examples: deleting records, changing a user's permissions, sending an email to an executive, pushing code, outbound HTTP.
- The rule: one agent holds red or blue, never both. An injection needs untrusted content to plant the instruction and a critical action to execute it. Separate the colors across agents and the attack chain breaks.
| Red (untrusted content) | Blue (critical action) |
|---|---|
| Web search / fetch tool | Delete database records |
| PDF or document from an outside party | Change a user's permissions |
| Inbound email or message | Send email to an executive |
| Internet-sourced data lookup | Push code / merge a PR |
| Subagent charter from an untrusted caller | Outbound network request |
Label every tool and data input once. For MCP tools and resources, store the color in the _meta object. Classification scales through an LLM labeler when the criteria for red, blue, and neither are written down clearly.
De-coloring (declassification): validate red content to remove its color, the way a web form validates input. A human review or an LLM-as-a-judge check can promote untrusted content to trusted, which lets red and blue coexist in one agent when the content has been cleared. This is the escape hatch that keeps benign flows like "read this document, send a summary" from being blocked.
Color levels (graduated trust): replace the binary label with levels 1 to 5 per color plus thresholds. Partial trust decouples the base color labels from a given user's risk tolerance and gives a high-level view of the risk being taken without requiring knowledge of the agent's internals.
Prismor ships MCP Colors as tool-combination governance. Tools carry customizable tags. A policy declares forbidden tag combinations, and the tool call that would complete a forbidden combination is blocked before it executes, based on prior session history.
settings:
tool_tags:
enabled: true
mode: enforce # observe | enforce
detector: strict_combination
tags:
mcp__Gmail__read_email: [untrusted_content] # red
mcp__Gmail__send_email: [critical_action] # blue
incompatible:
- [untrusted_content, critical_action] # default red/blue ruleThe block runs at the pre-invocation gate, the only phase that is synchronous, before execution, and immune to response streaming. Enforcement is terminal and non-overridable in enforce mode. The default detector is strict_combination; a risk_score detector implements the graduated color-levels variant.
MCP Colors AI agent security prompt injection defense lethal trifecta Simon Willison Model Context Protocol MCP security tool-combination governance agent tool tagging red blue tool labeling LLM security agent policy enforcement prompt injection mitigation how to secure an AI agent how to prevent prompt injection in agents untrusted content vs critical action pre-invocation gate LangChain CrewAI OpenAI Agents SDK Prismor enterprise AI agent governance agent access control de-coloring declassification