Authors: Tobias Mattsson, Samuel Nyberg, Anton Borg, Ricardo Britto
Organizations: Blekinge Institute of Technnology, Sweden · Department of Computer Science, Blekinge Institute of Technology, Sweden · Ericsson, Sweden · Department of Software Engineering, Blekinge Institute of Technology, Sweden
The Model Context Protocol (MCP) is a new and emerging technology that extends the functionality of large language models, improving workflows but also exposing users to a new attack surface. Several studies have highlighted related security flaws, but MCP attack detection remains underexplored. To address this research gap, this study develops and evaluates a range of supervised machine learning approaches, including both traditional and deep-learning models. We evaluated the systems on the detection of malicious MCP tool descriptions in two scenarios: (1) a binary classification task distinguishing malicious from benign tools, and (2) a multiclass classification task identifying the attack type while separating benign from malicious tools. In addition to the machine learning models, we compared a rule-based approach that serves as a baseline. The results indicate that several of the developed models achieved 100% F1-score on the binary classification task. In the multiclass scenario, the SVC and BERT models performed best, achieving F1 scores of 90.56% and 88.33%, respectively. Confusion matrices were also used to visualize the full distribution of predictions often missed by traditional metrics, providing additional insight for selecting the best-fitting solution in real-world scenarios. This study presents an addition to the MCP defence area, showing that machine learning models can perform exceptionally well in separating malicious and benign data points. To apply the solution in a live environment, a middleware was developed to classify which MCP tools are safe to use before execution, and block the ones that are not safe. Furthermore, the study shows that these models can outperform traditional rule-based solutions currently in use in the field.
Figures & tables
Figure 1: Design flow of project structure
Figure 2: Flowchart for middleware when intercepting MCP-tool call
Figure 3: Class distribution of malicious MCP-tox dataset
Figure 4: Cosine similarity distance between classes
Figure 5: Cosine Similarity matrix after class concatenation
Model
Accuracy
Precision
Recall
F1 Score
YARA
69.01%
62.50%
20.83%
31.25%
BERT *
56.34%
11.11%
4.17%
6.06%
BERT
100.00%
100.00%
100.00%
100.00%
SVC
100.00%
100.00%
100.00%
100.00%
BiLSTM
100.00%
100.00%
100.00%
100.00%
Table 1: Binary models
Figure 6: Confusion matrices for binary classification.
Model
Accuracy
Precision
Recall
F1 Score
BERT *
11.27%
40.97%
11.27%
12.76%
BERT
88.73%
89.01%
88.73%
88.33%
SVC
91.55%
90.45%
91.55%
90.56%
BiLSTM
76.06%
76.97%
76.06%
75.62%
Table 2: Multi-class models with 11 classes
Figure 7: Confusion matrices for multiclass classification.
Model
Accuracy
Precision
Recall
F1 Score
BERT *
14.79%
45.93%
14.79%
12.24%
BERT
97.89%
98.10%
97.89%
97.66%
SVC
95.77%
95.43%
95.77%
95.25%
BiLSTM
74.65%
92.77%
74.65%
74.67%
Table 3: Multi-class models with concatenated classes
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
Figure 8: Visualization of the tokens that influence the BERT model’s decisions.
The Model Context Protocol (MCP) is an open-source standard that allows AI agents to connect to external tools, databases, and services. While this connectivity enables powerful agent capabilities, it also introduces multi-step attacks that existing per-call defenses cannot reliably detect. Attackers can compose individually benign tool invocations into malicious sequences that evade isolated inspection. This paper presents ChainWatch, a sequential detection framework for identifying multi-step attacks in MCP-based AI agent systems. ChainWatch models attack progression using a six-stage kill chain and applies a Hidden Markov Model (HMM) to classify tool-call sequences. Detection rules are triggered when a session exhibits suspicious progression across multiple stages. The framework is supported by a structured threat model covering direct sequential attacks, indirect prompt injection chains, and hybrid multi-stage attacks. A 20-dimensional feature extraction schema captures behavioral signals from tool interactions. We demonstrate the approach using five representative attack scenarios from the security literature, showing how ChainWatch detects attack chains that evade traditional per-call security mechanisms.
Om Narayan, Rashmi Jyoti, Ramkinker Singh
Computer Science New York University New York, USA · Cybersecurity University of Maryland, College Park MD, USA · Carnegie Mellon University Pittsburgh, USA
The Model Context Protocol (MCP) enables large language models (LLMs) to dynamically discover and invoke third-party tools, significantly expanding agent capabilities while introducing a distinct security landscape. Unlike prompt-only interactions, MCP exposes pre-execution artifacts, shared context, multi-turn workflows, and third-party supply chains to adversarial influence across independently operated components. While recent work has identified MCP-specific attacks and evaluated defenses, existing studies are largely attack-centric or benchmark-driven, providing limited guidance on where mitigation responsibility should reside within the MCP architecture. This is problematic given MCP's multi-party design and distributed trust boundaries. We present a defense-placement-oriented security analysis of MCP, introducing a layer-aligned taxonomy that organizes attacks by the architectural component responsible for enforcement. Threats are mapped across six MCP layers, and primary and secondary defense points are identified to support principled defense-in-depth reasoning under adversaries controlling tools, servers, or ecosystem components. A structured mapping of existing academic and industry defenses onto this framework reveals uneven and predominantly tool-centric protection, with persistent gaps at the host orchestration, transport, and supply-chain layers. These findings suggest that many MCP security weaknesses stem from architectural misalignment rather than isolated implementation flaws.
The Model Context Protocol (MCP) has become a widely adopted interface for LLM agents to invoke external tools, yet learned monitoring of MCP tool-call traffic remains underexplored. In this article, the proposed detector is presented as an attack detection framework for MCP tool-call traffic that encodes each agent session as a graph (tool calls as nodes, sequential and data-flow links as edges), enriches nodes with sentence-embedding features over arguments and responses, and classifies sessions as benign or attacked. Three GNN architectures (GAT, GCN, GraphSAGE), a no-graph MLP, and classical baselines (XGBoost, random forest, logistic regression, linear SVM) are evaluated, with the full architecture comparison conducted on RAS-Eval (task-stratified splits) and GraphSAGE retained as the GNN baseline on ATBench and a combined-source variant (both label-stratified). Three findings emerge. First, content-level features are essential: metadata-only detection plateaus around an AUROC of 0.64 regardless of architecture, while content embeddings push the AUROC above 0.89. Second, naive random-split evaluation inflates AUROC by up to 26 percentage points relative to task-disjoint splits, a memorization confound that prior agent-detection work has not addressed. Third, the detection signal resides primarily in the SBERT content embeddings: an AUROC of 0.975 was reached by tree ensembles on pooled embeddings, performing, for the most part, better than the neural architectures in the primary RAS-Eval setting including GNNs (0.917) and the MLP (0.896), and self-supervised pre-training does not deliver a label-efficiency advantage on this task.
Sultan Zavrak
Department of Computer Engineering, Duzce University, Duzce, Turkey