MCP injects third-party text (tool names, tool descriptions, tool return results) directly into the model's context, and depending on the client implementation, this content is often assigned a higher trust weight than user input.