MCP Security

MCP: Model Context Protocol

MCP security examines risks in how AI agents discover and invoke tools, including weak authentication, malicious or misleading tool metadata, prompt injection, and unsafe data flows across servers. Researchers use threat taxonomies, static and dynamic code analysis, attack benchmarks, and trace-based evaluation to find vulnerabilities and measure how agents respond. Defenses include fine-grained authorization, runtime gateways, sandboxing, semantic detection, and cryptographic signing and audit logs. A central challenge is that protections are distributed unevenly across system layers: prompt-based defenses often fail, while stronger enforcement can add overhead, restrict useful behavior, and be difficult to evaluate consistently.

Latest papers

41 papers1 paper in the last four weeks, down 80% on the four weeks before. 0.0% of all new papers.

Machine Learning-Based Detection of MCP Attacks
Apr 12, 2026Tobias Mattsson, Samuel Nyberg, Anton Borg +1Classification MCP Security
Blekinge Institute of Technnology, Sweden · Department of Computer Science, Blekinge Institute of Technology, Sweden · Ericsson, Sweden +1
MCP-DPT: A Defense-Placement Taxonomy and Coverage Analysis for Model Context Protocol Security
Apr 8, 2026Mehrdad Rostamzadeh, Sidhant Narula, Nahom Birhan +2MCP Security AI Agent Security
Old Dominion University, Norfolk, Virginia, USA · Old Dominion Univer, Norfolk, Virginia, USA
A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanisms
Apr 7, 2026Nirajan Acharya, Gaurav Kumar GuptaMCP Security AI Agent Security
University of the Cumberlands · Youngstown State University
Invisible Threats from Model Context Protocol: Generating Stealthy Injection Payload via Tree-based Adaptive Search
Mar 25, 2026Yulin Shen, Xudong Pan, Geng Hong +1Prompt Injection Attacks on AI Agents MCP Security
School of Computer Science, Fudan University · Shanghai Innovation Institute
MCP-38: A Comprehensive Threat Taxonomy for Model Context Protocol Systems (v1.0)
Mar 18, 2026Yi Ting Shen, Kentaroh Toyoda, Alex LeungMCP Security LLM Security
Vulcan Research, AIFT
MCP-in-SoS: Risk assessment framework for open-source MCP servers
Mar 10, 2026Pratyay Kumar, Miguel Antonio Guirao Aguilera, Srikathyayani Srikanteswara +2MCP Security Cybersecurity
New Mexico State University · GenAI and ML Research Visionary · University of Hartford
Compatibility at a Cost: Systematic Discovery and Exploitation of MCP Clause-Compliance Vulnerabilities
Mar 10, 2026Nanzi Yang, Weiheng Bai, Kangjie LuMCP Security AI Agent Security
University of Minnesota Minneapolis, USA
Give Them an Inch and They Will Take a Mile:Understanding and Measuring Caller Identity Confusion in MCP-Based AI Systems
Mar 8, 2026Yuhang Huang, Boyang Ma, Biwei Yan +5MCP Security AI Agent Security
Shandong University Qingdao, Shandong, China · City University of Hong Kong Hong Kong, Hong Kong, China
From Tool Orchestration to Code Execution: A Study of MCP Design Choices
Feb 17, 2026Yuval Felendler, Parth A. Gandhi, Idan Habler +2LLM Agent Orchestration MCP Security
Faculty of Computer and Information Science, Ben Gurion University of The Negev
Overthinking Loops in Agents: A Structural Risk via MCP Tools
Feb 16, 2026Yohan Lee, Jisoo Jang, Seoyeon Choi +2LLM Agent Security Tool-Using Agents
Yonsei University · Division of Language and AI, Hankuk University of Foreign Studies (HUFS) · Department of Data Science, Ewha Womans University
Verifiable Manifest Signing and Transparency Enforcement for Secure MCP-Based LLM Pipelines
Jan 30, 2026Saeid Jamshidi, Kawser Wazed Nafi, Arghavan Moradi Dakhel +2LLM Auditing MCP Security
SWAT Laboratory, Polytechnique Montr´eal, Montr´eal, Canada · SæT Laboratory, Polytechnique Montr´eal, Montr´eal, Canada

Apr 12, 2026J/K move · Enter open · S save

Machine Learning-Based Detection of MCP Attacks

Tobias Mattsson, Samuel Nyberg, Anton Borg, Ricardo Britto

Blekinge Institute of Technnology, Sweden · Department of Computer Science, Blekinge Institute of Technology, Sweden · Ericsson, Sweden+1

Classification MCP Security LLM Security

Open paper AskPDF arXiv

The Model Context Protocol (MCP) is a new and emerging technology that extends the functionality of large language models, improving workflows but also exposing users to a new attack surface. Several studies have highlighted related security flaws, but MCP attack detection remains underexplored. To address this research gap, this study develops and evaluates a range of supervised machine learning approaches, including both traditional and deep-learning models. We evaluated the systems on the detection of malicious MCP tool descriptions in two scenarios: (1) a binary classification task distinguishing malicious from benign tools, and (2) a multiclass classification task identifying the attack type while separating benign from malicious tools. In addition to the machine learning models, we compared a rule-based approach that serves as a baseline. The results indicate that several of the developed models achieved 100% F1-score on the binary classification task. In the multiclass scenario, the SVC and BERT models performed best, achieving F1 scores of 90.56% and 88.33%, respectively. Confusion matrices were also used to visualize the full distribution of predictions often missed by traditional metrics, providing additional insight for selecting the best-fitting solution in real-world scenarios. This study presents an addition to the MCP defence area, showing that machine learning models can perform exceptionally well in separating malicious and benign data points. To apply the solution in a live environment, a middleware was developed to classify which MCP tools are safe to use before execution, and block the ones that are not safe. Furthermore, the study shows that these models can outperform traditional rule-based solutions currently in use in the field.