MCP-DPT: A Defense-Placement Taxonomy and Coverage Analysis for Model Context Protocol Security

Mehrdad Rostamzadeh; Sidhant Narula; Nahom Birhan; Mohammad Ghasemigol; Daniel Takabi

cs.CRApr 8, 2026

MCP-DPT: A Defense-Placement Taxonomy and Coverage Analysis for Model Context Protocol Security

Authors: Mehrdad Rostamzadeh, Sidhant Narula, Nahom Birhan, Mohammad Ghasemigol, Daniel Takabi

Organizations: Old Dominion University, Norfolk, Virginia, USA · Old Dominion Univer, Norfolk, Virginia, USA

Abstract

The Model Context Protocol (MCP) enables large language models (LLMs) to dynamically discover and invoke third-party tools, significantly expanding agent capabilities while introducing a distinct security landscape. Unlike prompt-only interactions, MCP exposes pre-execution artifacts, shared context, multi-turn workflows, and third-party supply chains to adversarial influence across independently operated components. While recent work has identified MCP-specific attacks and evaluated defenses, existing studies are largely attack-centric or benchmark-driven, providing limited guidance on where mitigation responsibility should reside within the MCP architecture. This is problematic given MCP's multi-party design and distributed trust boundaries. We present a defense-placement-oriented security analysis of MCP, introducing a layer-aligned taxonomy that organizes attacks by the architectural component responsible for enforcement. Threats are mapped across six MCP layers, and primary and secondary defense points are identified to support principled defense-in-depth reasoning under adversaries controlling tools, servers, or ecosystem components. A structured mapping of existing academic and industry defenses onto this framework reveals uneven and predominantly tool-centric protection, with persistent gaps at the host orchestration, transport, and supply-chain layers. These findings suggest that many MCP security weaknesses stem from architectural misalignment rather than isolated implementation flaws.

Figures & tables

Figure 1. Primary and secondary defense layers for a rug pull attack.

Aspect	MCPSec Bench ( Yang et al., 2025b )	MSB ( Zhang et al., 2025 )	MCP-Safety Bench ( Zong et al., 2025 )	MCPLib ( Guo et al., 2025a )	When MCP Servers Attack ( Zhao et al., 2025b )	MCIP ( Jing et al., 2025 )	MCP-DPT (This Work)
Primary focus	Security benchmark	Attack benchmark	Safety benchmark	Attack library/ taxonomy	Malicious MCP servers	Safety-enhanced protocol	Defense placement
Taxonomy type	Attack-surface	Pipeline-stage attack	Safety-scenario	Attack-method taxonomy	Server-component attack	Unsafe-behavior/ lifecycle taxonomy	Defense-placement taxonomy
Attack-centric	$\checkmark$	$\checkmark$	$\checkmark$	$\checkmark$	$\checkmark$	$\sim$	$\times$
Control-/defense-centric	$\sim$	$\times$	$\times$	$\times$	$\sim$	$\checkmark$	$\checkmark$
Maps attacks $\rightarrow$ defenses	$\times$	$\times$	$\times$	$\times$	$\sim$	$\sim$	$\checkmark$
Assigns enforcement responsibility	$\times$	$\times$	$\times$	$\times$	$\times$	$\times$	$\checkmark$

Table 1. Comparison of MCP security benchmarks and analyses with respect to defense placement and enforcement responsibility.

\checkmark

= fully supported;

\sim

= partially supported;

\times

= not supported.

Attack

MCP-Scan

MCIP-Guardian

Cisco MCP Scanner

MCP-Gateway

MCP Guardian (eqtylab)

MCP-Defender

MCP-Guard

Prisma AIRS

MCPScan.ai

MCP-Shield

ToolHive

MindGuard

AIM-Guard-MCP

Model Provider / LLM Alignment

Prompt Injection

\bullet

\bullet

\bullet

\circ

\circ

\bullet

\bullet

\bullet

\circ

\bullet

\circ

\circ

\bullet

Tool/Service Misuse (“Confused AI”)

\circ

\bullet

\circ

\circ

\bullet

\bullet

\bullet

\bullet

\circ

\circ

\circ

\circ

\bullet

Jailbreak Attacks

\circ

\circ

\circ

\circ

\circ

\circ

\bullet

\bullet

\circ

\circ

\circ

\circ

\circ

Hallucination Attacks

\circ

\bullet

\circ

\circ

\circ

\circ

\bullet

\bullet

\circ

\circ

\circ

\circ

\circ

Prompt Leakage

\bullet

\bullet

\bullet

\circ

\circ

\circ

\bullet

\bullet

\circ

\bullet

\circ

\circ

\circ

Table 2. Capability-based defense coverage across all 49 taxonomy attacks and 13 defense mechanisms, organized by the primary MCP architectural layer responsible for enforcement.

\bullet

= covered;

\circ

= not covered.

Defense Mechanism	Static / Pre-Exec.	Behavior / Runtime	Isolation / Architect.	Decision Level
MCP-Scan (Invariant Labs)	$\bullet$	$\circ$	$\circ$	$\circ$
MCPScan.ai	$\bullet$	$\circ$	$\circ$	$\circ$
MCIP-Guardian	$\circ$	$\bullet$	$\circ$	$\circ$
AegisMCP	$\circ$	$\bullet$	$\circ$	$\circ$
MCP-Defender	$\circ$	$\bullet$	$\circ$	$\circ$
MCP-Gateway / Lasso	$\circ$	$\circ$	$\bullet$	$\circ$

Table 3. Categorical mapping of representative MCP defense mechanisms across four orthogonal defense types.

\bullet

= supported;

\circ

= not supported.

Defense Mechanism	MP/LA	MH/A	R/M&SC	MC/S	MS/TE	T/N
MCP-Scan	11%	8%	83%	9%	33%	0%
MCIP-Guardian	44%	8%	0%	0%	17%	0%
Cisco MCP	11%	0%	17%	0%	0%	0%
MCP-Gateway	22%	38%	0%	9%	33%	50%
MCP-Guardian	33%	8%	0%	36%	50%	0%
MCP-Defender	11%	31%	0%	36%	33%	0%

Table 4. Defense Coverage Across MCP Ecosystem Layers

Explore similar work

A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanisms
Apr 7, 2026Nirajan Acharya, Gaurav Kumar GuptaMCP Security AI Agent Security
University of the Cumberlands · Youngstown State University
Machine Learning-Based Detection of MCP Attacks
Apr 12, 2026Tobias Mattsson, Samuel Nyberg, Anton Borg +1MCP Security LLM Security
Blekinge Institute of Technnology, Sweden · Department of Computer Science, Blekinge Institute of Technology, Sweden · Ericsson, Sweden +1
MCP-38: A Comprehensive Threat Taxonomy for Model Context Protocol Systems (v1.0)
Mar 18, 2026Yi Ting Shen, Kentaroh Toyoda, Alex LeungMCP Security LLM Security
Vulcan Research, AIFT

Apr 7, 2026J/K move · Enter open · S save

A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanisms

Nirajan Acharya, Gaurav Kumar Gupta

University of the Cumberlands · Youngstown State University

MCP Security AI Agent Security Tool Access Control for LLM Agents Formal Verification

Open paper AskPDF arXiv

The Model Context Protocol (MCP), introduced by Anthropic in November 2024 and now governed by the Linux Foundation's Agentic AI Foundation, has rapidly become the de facto standard for connecting large language model (LLM)-based agents to external tools and data sources, with over 97 million monthly SDK downloads and more than 177000 registered tools. However, this explosive adoption has exposed a critical gap: the absence of a unified, formal security framework capable of systematically characterizing, analyzing, and mitigating the diverse threats facing MCP-based agent ecosystems. Existing security research remains fragmented across individual attack papers, isolated benchmarks, and point defense mechanisms. This paper presents MCPSHIELD, a comprehensive formal security framework for MCP-based AI agents. We make four principal contributions: (1) a hierarchical threat taxonomy comprising 7 threat categories and 23 distinct attack vectors organized across four attack surfaces, grounded in the analysis of over 177000 MCP tools; (2) a formal verification model based on labeled transition systems with trust boundary annotations that enables static and runtime analysis of MCP tool interaction chains; (3) a systematic comparative evaluation of 12 existing defense mechanisms, identifying coverage gaps across our threat taxonomy; and (4) a defense in depth reference architecture integrating capability based access control, cryptographic tool attestation, information flow tracking, and runtime policy enforcement. Our analysis reveals that no existing single defense covers more than 34 percent of the identified threat landscape, whereas MCPSHIELD's integrated architecture achieves theoretical coverage of 91 percent. We further identify seven open research challenges that must be addressed to secure the next generation of agentic AI systems.

Abstract

Explore similar work

A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanisms

Machine Learning-Based Detection of MCP Attacks

MCP-38: A Comprehensive Threat Taxonomy for Model Context Protocol Systems (v1.0)