In short

Scope: defenses actually implemented in arleo.eu’s MCP server (mcp-hugo-server-go) against indirect prompt injection and tool poisoning, available since v1.9.3: systematic provenance tagging (content_provenance), a tool-registry fingerprint (tool_registry_digest), explicit untrusted-derivation self-declaration, a delete-confirmation gate, a documented threat model. Not covered: this isn’t an incident — this article documents a defense architecture, not an after-the-fact fix. What remains out of scope (client-side mitigation, semantic filtering deliberately rejected) is detailed further below.