A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanisms

Nirajan Acharya; Gaurav Kumar Gupta

cs.CRApr 7, 2026

A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanisms

Authors: Nirajan Acharya, Gaurav Kumar Gupta

Organizations: University of the Cumberlands · Youngstown State University

Abstract

The Model Context Protocol (MCP), introduced by Anthropic in November 2024 and now governed by the Linux Foundation's Agentic AI Foundation, has rapidly become the de facto standard for connecting large language model (LLM)-based agents to external tools and data sources, with over 97 million monthly SDK downloads and more than 177000 registered tools. However, this explosive adoption has exposed a critical gap: the absence of a unified, formal security framework capable of systematically characterizing, analyzing, and mitigating the diverse threats facing MCP-based agent ecosystems. Existing security research remains fragmented across individual attack papers, isolated benchmarks, and point defense mechanisms. This paper presents MCPSHIELD, a comprehensive formal security framework for MCP-based AI agents. We make four principal contributions: (1) a hierarchical threat taxonomy comprising 7 threat categories and 23 distinct attack vectors organized across four attack surfaces, grounded in the analysis of over 177000 MCP tools; (2) a formal verification model based on labeled transition systems with trust boundary annotations that enables static and runtime analysis of MCP tool interaction chains; (3) a systematic comparative evaluation of 12 existing defense mechanisms, identifying coverage gaps across our threat taxonomy; and (4) a defense in depth reference architecture integrating capability based access control, cryptographic tool attestation, information flow tracking, and runtime policy enforcement. Our analysis reveals that no existing single defense covers more than 34 percent of the identified threat landscape, whereas MCPSHIELD's integrated architecture achieves theoretical coverage of 91 percent. We further identify seven open research challenges that must be addressed to secure the next generation of agentic AI systems.

Figures & tables

Threat Category	Attack Vector	Surface	Attacker	MCPTox	SafetyBench	SecBench
TC1: Tool Poisoning	TV1: Description injection	$\mathcal{S}_{\text{tool}}$	Developer	✓	✓	✓
	TV2: Schema manipulation	$\mathcal{S}_{\text{tool}}$	Developer	$\circ$	—	✓
	TV3: Return value poisoning	$\mathcal{S}_{\text{tool}}$	External	✓	$\circ$	$\circ$
	TV4: Tool shadowing	$\mathcal{S}_{\text{tool}}$	Developer	—	—	✓
TC2: Rug Pull & Mutation	TV5: Post-approval mutation	$\mathcal{S}_{\text{server}}$	Developer	—	—	$\circ$
	TV6: Version rollback	$\mathcal{S}_{\text{server}}$	Developer	—	—	—

TABLE I: Unified Threat Taxonomy for MCP-Based AI Agents. Attack vectors are mapped to attack surfaces (

\mathcal{S}

), attacker type, and existing benchmark/paper coverage (✓= covered,

\circ

= partially covered, — = not covered).

Defense	TC1	TC2	TC3	TC4	TC5	TC6	TC7	Cov.
D1: ETDI	$\cdot$	●	$\cdot$	◐	◐	$\cdot$	$\cdot$	22%
D2: MCP-Guard	●	$\cdot$	$\cdot$	$\cdot$	$\cdot$	●	$\cdot$	30%
D3: MCPGuard	●	$\cdot$	$\cdot$	$\cdot$	◐	$\cdot$	$\cdot$	22%
D4: Manifest	●	●	$\cdot$	$\cdot$	◐	$\cdot$	$\cdot$	26%
D5: MCPS	$\cdot$	$\cdot$	$\cdot$	$\cdot$	●	$\cdot$	●	26%
D6: Spec	$\cdot$	$\cdot$	$\cdot$	◐	$\cdot$	$\cdot$	$\cdot$	9%

TABLE II: Defense mechanism coverage across threat categories. ● = full coverage, ◐ = partial coverage,

\cdot

= no coverage. Max coverage column shows the percentage of the 23 attack vectors addressed.

Layer	TC1	TC2	TC3	TC4	TC5	TC6	TC7	Cov.
L-CAC	◐	$\cdot$	$\cdot$	●	$\cdot$	$\cdot$	$\cdot$	17%
L-CTA	●	●	$\cdot$	$\cdot$	●	$\cdot$	◐	39%
L-IFT	$\cdot$	$\cdot$	●	◐	$\cdot$	◐	$\cdot$	22%
L-RPE	●	◐	◐	●	◐	●	●	70%
Combined	●	●	●	●	●	●	●	91%

TABLE III: MCPShield layer coverage across threat categories.

Explore similar work

Apr 15, 2026

MCPThreatHive: Automated Threat Intelligence for Model Context Protocol Ecosystems

The rapid proliferation of Model Context Protocol (MCP)-based agentic systems has introduced a new category of security threats that existing frameworks are inadequately equipped to address. We present MCPThreatHive, an open-source platform that automates the end-to-end lifecycle of MCP threat intelligence: from continuous, multi-source data collection through AI-driven threat extraction and classification, to structured knowledge graph storage and interactive visualization. The platform operationalizes the MCP-38 threat taxonomy, a curated set of 38 MCP-specific threat patterns mapped to STRIDE, OWASP Top 10 for LLM Applications, and OWASP Top 10 for Agentic Applications. A composite risk scoring model provides quantitative prioritization. Through a comparative analysis of representative existing MCP security tools, we identify three critical coverage gaps that MCPThreatHive addresses: incomplete compositional attack modeling, absence of continuous threat intelligence, and lack of unified multi-framework classification.

Yi Ting Shen, Kentaroh Toyoda, Alex Leung

Vulcan Research, AIFT

MCP Security AI Agent Security Cyber Threat Intelligence

Ask PDF

Apr 8, 2026

MCP-DPT: A Defense-Placement Taxonomy and Coverage Analysis for Model Context Protocol Security

The Model Context Protocol (MCP) enables large language models (LLMs) to dynamically discover and invoke third-party tools, significantly expanding agent capabilities while introducing a distinct security landscape. Unlike prompt-only interactions, MCP exposes pre-execution artifacts, shared context, multi-turn workflows, and third-party supply chains to adversarial influence across independently operated components. While recent work has identified MCP-specific attacks and evaluated defenses, existing studies are largely attack-centric or benchmark-driven, providing limited guidance on where mitigation responsibility should reside within the MCP architecture. This is problematic given MCP's multi-party design and distributed trust boundaries. We present a defense-placement-oriented security analysis of MCP, introducing a layer-aligned taxonomy that organizes attacks by the architectural component responsible for enforcement. Threats are mapped across six MCP layers, and primary and secondary defense points are identified to support principled defense-in-depth reasoning under adversaries controlling tools, servers, or ecosystem components. A structured mapping of existing academic and industry defenses onto this framework reveals uneven and predominantly tool-centric protection, with persistent gaps at the host orchestration, transport, and supply-chain layers. These findings suggest that many MCP security weaknesses stem from architectural misalignment rather than isolated implementation flaws.

Mehrdad Rostamzadeh, Sidhant Narula, Nahom Birhan +2

Old Dominion University, Norfolk, Virginia, USA · Old Dominion Univer, Norfolk, Virginia, USA

MCP Security AI Agent Security

Ask PDF

Sep 22, 2026

A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem

Agents using the Model Context Protocol (MCP) rely on semantic matching to select tools from third-party servers, exposing a semantic supply-chain risk through attacker-controlled metadata and outputs. We introduce A2M (Attraction-to-Manipulation), a two-stage black-box framework for hijacking MCP agents. The Attraction phase optimizes tool metadata to increase invocation probability; the Manipulation phase uses execution traces to refine adversarial tool returns that steer agents toward attacker-desired outcomes. On LiveMCPBench, direct attacks optimized and evaluated on GLM-4.6 achieve a macro-average malicious tool invocation rate of 93.6% across four scenarios, increase weighted token costs to 32.4

\times

the benign baseline under Cognitive Denial of Service, and attain a mean attack success rate of 74.4% across Information Exfiltration, Environment Integrity Compromise, and Reasoning Derailment. Transfer to four other models without re-optimization yields corresponding macro-averages of 63.6%, 2.7

\times

, and 24.5%. These findings motivate stronger tool vetting and runtime isolation in MCP ecosystems. Code is publicly available at https://github.com/Lilaizhen/A2M.

Laizhen Li, Xuan Wang, Peicheng Zhao +4

Shenzhen Institutes of Advanced Technology, Chinese Academy of Sciences · University of Chinese Academy of Sciences · Nanyang Technological University +3

MCP Security AI Agent Security Black-Box Adversarial Attacks

Ask PDF