Control chars & bidi in result

control-characters · Tools — execution

Endpoint (Streamable HTTP)

https://chaos-mcp.thomascdnns.com/s/control-characters/mcp

On the wire — recorded from a real request

Symptom

what you'll observe

Output renders weirdly, corrupts the terminal, or hides/spoofs text via bidi overrides.

Cause

what this reproduces

Returning raw bytes (ANSI escapes, NUL, zero-width, right-to-left override) without sanitising.

Fix

how you'd resolve it

Strip/escape control and bidi characters before returning tool output.

Try it with curl

bash

curl -sS -X POST \
  https://chaos-mcp.thomascdnns.com/s/control-characters/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2024-11-05",
      "capabilities": {},
      "clientInfo": {"name": "curl", "version": "1"}
    }
  }'