cs.CRFeb 17, 2026

From Tool Orchestration to Code Execution: A Study of MCP Design Choices

Authors: Yuval Felendler, Parth A. Gandhi, Idan Habler, Yuval Elovici, Asaf Shabtai

Organizations: Faculty of Computer and Information Science, Ben Gurion University of The Negev

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Model Context Protocols (MCPs) provide a unified platform for agent systems to discover, select, and orchestrate tools across heterogeneous execution environments. As MCP-based systems scale to incorporate larger tool catalogs and multiple concurrently connected MCP servers, traditional tool-by-tool invocation increases coordination overhead, fragments state management, and limits support for wide-context operations. To address these scalability challenges, recent MCP designs have incorporated code execution as a first-class capability, an approach called Code Execution MCP (CE-MCP). This enables agents to consolidate complex workflows, such as SQL querying, file analysis, and multi-step data transformations, into a single program that executes within an isolated runtime environment. In this work, we formalize the architectural distinction between context-coupled (traditional) and context-decoupled (CE-MCP) models, analyzing their fundamental scalability trade-offs. Using the MCP-Bench framework across 10 representative servers, we empirically evaluate task behavior, tool utilization patterns, execution latency, and protocol efficiency as the scale of connected MCP servers and available tools increases, demonstrating that while CE-MCP significantly reduces token usage and execution latency, it introduces a vastly expanded attack surface. We address this security gap by applying the MAESTRO framework, identifying sixteen attack classes across five execution phases-including specific code execution threats such as exception-mediated code injection and unsafe capability synthesis. We validate these vulnerabilities through adversarial scenarios across multiple LLMs and propose a layered defense architecture comprising containerized sandboxing and semantic gating. Our findings provide a rigorous roadmap for balancing scalability and security in production-ready executable agent workflows.

Figures & tables

Figure 1: MCP flow. The MCP allows different AI applications to connect to different MCP servers and use their resources, prompts, data, and tools.
Figure 2: CE-MCP workflow. The figure illustrates the actions performed by the agent, from the user query to the final answer returned to the user, including tool discovery, code generation and planning, code execution, and result handling and validation.
Figure 3: Threat vectors across the CE-MCP execution flow phases modeled via MAESTRO. The figure illustrates how adversarial influence can be introduced during tool discovery, code generation, execution, response handling, and runtime impact.
PhaseIDThreat DescriptionLayer
Tool DiscoveryP1.1Context injection via discovery artifactsL2
 P1.2Semantic manipulation via tool metadataL3
Code Generation and PlanningP2.1Hijacking via adversarial context/inputsL1
 P2.2Planning manipulation via tool exceptionsL5
Code ExecutionP3.1Code-flow injection via untrusted tool outputsL7
 P3.2Execution sink manipulation (Shell/SQL)L7
Table 1: Mapping of CE-MCP threats to MAESTRO layers.
Figure 4: Total token usage for the MCP and CE-MCP, aggregated across all models and servers.
Figure 5: End-to-end execution time distribution for the MCP and CE-MCP
Figure 6: Number of turns per task for the MCP and CE-MCP.
Figure 7: Task fulfillment score distribution for the MCP and CE-MCP across all models and server configurations. The CE-MCP’s task fulfillment is comparable to that of the MCP in most settings.
Figure 8: Tool selection score distribution for the MCP and CE-MCP. The CE-MCP maintains comparable tool selection accuracy despite its dynamic tool discovery process, demonstrating reliable orchestration despite reduced interaction.
Figure 9: The average task fulfillment achieved by the CE-MCP and traditional MCP agents across all evaluated MCP servers. Each server corresponds to a distinct task category with different reasoning and tool orchestration requirements.
Figure 10: Linear execution trace of an exception-mediated privilege escalation in the CE-MCP.
AttackMCPCE-MCPCIA ImpactObserved Impact
P1.1 Context injection via discovery artifacts✓✓IntegritySemantic corruption of query logic without execution-layer violations.
P2.1 Hijacking via adversarial context/inputs✓✓AvailabilityNon-terminating regeneration loop leading to denial of service.
P3.2 Execution sink manipulation–✓IntegrityPoisoned tool output propagates across tool boundaries, producing factually incorrect results.
P4.3 Authorization state corruption–✓Confidentiality, IntegrityAdversarial exception text induces unauthorized privilege escalation without sandbox escape.
Table 2: Summary of the evaluated adversarial attacks and their impact.
Figure 11: End-to-end Code Execution MCP (CE-MCP) agent workflow with layered mitigation.
More in this topic

LLM Agent Orchestration

Large language model agent orchestration coordinates models, tools, and workflows to complete complex tasks reliably and efficiently.

See all 458 papers

Explore similar work

CardsList
Jun 27, 2026

From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes

Model Context Protocol (MCP)-style ecosystems give language-model applications a practical connection layer for tools, resources, prompts, and transports. As agents move from connection to execution, security decisions often remain split across clients, servers, prompts, approval dialogs, OAuth deployments, and logs. This paper asks whether a runtime can make execution-layer invariants explicit and testable while preserving MCP-like workflows. We define eight invariants: metadata non-authority, grant-backed approval, canonical resources, principal binding, scoped capability invocation, source-and-target data-flow authorization, deny-path audit, and explicit protocol state. We implement these invariants in HCP, a Handle-Capability Protocol reference runtime for MCP-style agent execution that represents calls through principals, resources, grants, capabilities, handles, policy decisions, data-pipe checks, and audit entries. We evaluate HCP against two MCP-like baselines: a naive connection-layer runtime and a practice-informed connection-layer mitigation baseline with metadata linting, session checks, and per-call approvals. Across 10 benchmark cases, the naive baseline permits all modeled attacks, the mitigation baseline permits 6 of 10, and HCP blocks all 10 while preserving audit evidence. Ablations identify which runtime components block attacks and preserve forensic evidence. A local in-memory microbenchmark reports sub-millisecond mean latencies for measured policy, invocation, peek, and pipe operations. A bounded GitHub README-screening sample provides ecosystem signals, not vulnerability findings. The results support a narrow claim: MCP-style agent systems need an execution-control layer in addition to connection-layer conventions.

Ting Liu

SymbolicLight Research Foshan, Guangdong, China

MCP SecurityLLM Agent SecurityAI Agent Security BenchmarksCapability-Based SecurityTool Access Control for LLM AgentsRuntime Verification
AskPDF
Sep 22, 2026

A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem

Agents using the Model Context Protocol (MCP) rely on semantic matching to select tools from third-party servers, exposing a semantic supply-chain risk through attacker-controlled metadata and outputs. We introduce A2M (Attraction-to-Manipulation), a two-stage black-box framework for hijacking MCP agents. The Attraction phase optimizes tool metadata to increase invocation probability; the Manipulation phase uses execution traces to refine adversarial tool returns that steer agents toward attacker-desired outcomes. On LiveMCPBench, direct attacks optimized and evaluated on GLM-4.6 achieve a macro-average malicious tool invocation rate of 93.6% across four scenarios, increase weighted token costs to 32.4×\times the benign baseline under Cognitive Denial of Service, and attain a mean attack success rate of 74.4% across Information Exfiltration, Environment Integrity Compromise, and Reasoning Derailment. Transfer to four other models without re-optimization yields corresponding macro-averages of 63.6%, 2.7×\times, and 24.5%. These findings motivate stronger tool vetting and runtime isolation in MCP ecosystems. Code is publicly available at https://github.com/Lilaizhen/A2M.

Laizhen Li, Xuan Wang, Peicheng Zhao +4

Shenzhen Institutes of Advanced Technology, Chinese Academy of Sciences · University of Chinese Academy of Sciences · Nanyang Technological University +3

MCP SecurityAI Agent SecurityBlack-Box Adversarial Attacks
AskPDF
Apr 7, 2026

A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanisms

The Model Context Protocol (MCP), introduced by Anthropic in November 2024 and now governed by the Linux Foundation's Agentic AI Foundation, has rapidly become the de facto standard for connecting large language model (LLM)-based agents to external tools and data sources, with over 97 million monthly SDK downloads and more than 177000 registered tools. However, this explosive adoption has exposed a critical gap: the absence of a unified, formal security framework capable of systematically characterizing, analyzing, and mitigating the diverse threats facing MCP-based agent ecosystems. Existing security research remains fragmented across individual attack papers, isolated benchmarks, and point defense mechanisms. This paper presents MCPSHIELD, a comprehensive formal security framework for MCP-based AI agents. We make four principal contributions: (1) a hierarchical threat taxonomy comprising 7 threat categories and 23 distinct attack vectors organized across four attack surfaces, grounded in the analysis of over 177000 MCP tools; (2) a formal verification model based on labeled transition systems with trust boundary annotations that enables static and runtime analysis of MCP tool interaction chains; (3) a systematic comparative evaluation of 12 existing defense mechanisms, identifying coverage gaps across our threat taxonomy; and (4) a defense in depth reference architecture integrating capability based access control, cryptographic tool attestation, information flow tracking, and runtime policy enforcement. Our analysis reveals that no existing single defense covers more than 34 percent of the identified threat landscape, whereas MCPSHIELD's integrated architecture achieves theoretical coverage of 91 percent. We further identify seven open research challenges that must be addressed to secure the next generation of agentic AI systems.

Nirajan Acharya, Gaurav Kumar Gupta

University of the Cumberlands · Youngstown State University

MCP SecurityAI Agent SecurityTool Access Control for LLM AgentsFormal Verification
AskPDF