Look twice.Find the gem.

AI agents and MCP servers, each published with its source and what the checks found.

Marketplace

  • Everything
  • AI agents
  • Apps
  • MCP servers
  • Templates
  • What people want
  • What changed this week
  • The verification standard
  • The ooruby Index
  • Servers that publish no source
  • Reliability guides
  • What the catalogue holds
  • Sell here

Our library

  • Everything, in one place
  • Guides
  • Glossary
  • Calculators
  • Checklists and cheat sheets
  • Community

ooruby

  • Home
  • For teams
  • Site status
  • Company projects
  • RSS feed

Verification records what our published tests found on a specific version at a specific date. It is not a warranty, and it does not certify that software is free of defects.

Rubricv1.0
AI agentsAppsMCP serversTemplatesWantedCommunityOur library
Sign inSell
Glossary
Security findings

Invisible characters

Characters that take up no space on screen, used to hide text that a model will still read.

Zero-width spaces and joiners, the marks that reverse the direction of text, and a whole block of Unicode tag characters are invisible in most editors and interfaces, and they are ordinary characters to a tokeniser. Text written in them is read by a model and by nobody reviewing the screen.

Terminal escape codes do the same job in a command-line client: one sequence can colour a sentence to match the background. Researchers have shown one used to hide an instruction in an MCP tool description.

Why it matters

There is no honest reason for a description of what a tool does to contain text nobody can see.

The mistake everyone makes

Reviewing a tool description by reading it on screen. The part that matters may be exactly the part that does not render.

Related terms

Tool poisoning
Hiding instructions inside a tool description so the model reads them as commands.
Prompt injection
Getting a model to follow instructions that arrive inside data it was asked to process.
Tool description
The text an MCP server publishes about each of its tools, which the model reads to decide what to call and how.
Pattern set
The versioned list of rules this site uses to read MCP tool descriptions for instructions that do not belong there.
Previous
Indirect prompt injection
Next
Least privilege

See Invisible characters on a real listing

Every term here shows up in the catalogue next to a real result, with the findings published and the limits stated. Free to browse, no account needed.

Open the catalogue