mlsanityData to 14 Oct 2026

Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions

arXiv 2503.23278 ↗First posted 30 Mar 2025cs.CR cs.AIcited by 265

Not on the map. Why?

Cited by 200 in LLM agents and tool use, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

The Model Context Protocol (MCP) is an emerging open standard that defines a unified, bi-directional communication and dynamic discovery protocol between AI models and external tools or resources, aiming to enhance interoperability and reduce fragmentation across diverse systems. This paper presents a systematic study of MCP from both architectural and security perspectives. We first define the full lifecycle of an MCP server, comprising four phases (creation, deployment, operation, and maintenance), further decomposed into 16 key activities that capture its functional evolution. Building on this lifecycle analysis, we construct a comprehensive threat taxonomy that categorizes security and privacy risks across four major attacker types: malicious developers, external attackers, malicious users, and security flaws, encompassing 16 distinct threat scenarios. To validate these risks, we develop and analyze real-world case studies that demonstrate concrete attack surfaces and vulnerability manifestations within MCP implementations. Based on these findings, the paper proposes a set of fine-grained, actionable security safeguards tailored to each lifecycle phase and threat category, offering practical guidance for secure MCP adoption. We also analyze the current MCP landscape, covering industry adoption, integration patterns, and supporting tools, to identify its technological strengths as well as existing limitations that constrain broader deployment. Finally, we outline future research and development directions aimed at strengthening MCP's standardization, trust boundaries, and sustainable growth within the evolving ecosystem of tool-augmented AI systems.

Key facts. Cited by 265 papers in the map (data through 14 Oct 2026). Builds on 18 of its 73 references that are in the map. First posted on arXiv 30 Mar 2025.

Builds on

18 of 73 references.

References · 18

  1. 2023The Rise and Potential of Large Language Model Based Agents: A Surveycited by 1,439
  2. 2024A Survey on RAG Meeting LLMs: Towards Retrieval-Augmented Large Language Modelscited by 452
  3. 2024ToolSandbox: A Stateful, Conversational, Interactive Evaluation Benchmark for LLM Tool Use Capabilitiescited by 295
  4. 2024The Power of Noise: Redefining Retrieval for RAG Systemscited by 281
  5. 2024EASYTOOL: Enhancing LLM-based Agents with Concise Tool Instructioncited by 154
  6. 2024AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathwayscited by 127
  7. 2024Planning, Creation, Usage: Benchmarking LLMs for Comprehensive Tool Utilization in Real-World Complex Scenarioscited by 86
  8. 2024ToolSword: Unveiling Safety Issues of Large Language Models in Tool Learning Across Three Stagescited by 82
  9. 2024A Review of Prominent Paradigms for LLM-Based Agents: Tool Use (Including RAG), Planning, and Feedback Learningcited by 74
  10. 2024AvaTaR: Optimizing LLM Agents for Tool Usage via Contrastive Reasoningcited by 72
  11. 2024Imprompter: Tricking LLM Agents into Improper Tool Usecited by 68
  12. 2024Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agentscited by 65
6 more
  1. 2024Tool Learning in the Wild: Empowering Language Models as Automatic Tool Agentscited by 56
  2. 2025LLM Agents Making Agent Toolscited by 48
  3. 2025AgentGuard: Repurposing Agentic Orchestrator for Safety Evaluation of Tool Orchestrationcited by 25
  4. 2025ToolFuzz -- Automated Agent Tool Testingcited by 18
  5. 2024LLM App Store Analysis: A Vision and Roadmapcited by 13
  6. 2024Toolken+: Improving LLM Tool Usage with Reranking and a Reject Optioncited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 130; 2026: 135.

265 papers.

Sort:

By area:

  1. 2025From LLM Reasoning to Autonomous AI Agents: A Comprehensive Reviewcited by 149
  2. 2025A Survey of Context Engineering for Large Language Modelscited by 126
  3. 2025A Survey of Frontiers in LLM Reasoning: Inference Scaling, Learning to Reason, and Agentic Systemscited by 111
  4. 2025Agentic Reasoning and Tool Integration for LLMs via Reinforcement Learningcited by 110
  5. 2025DeepAgent: A General Reasoning Agent with Scalable Toolsetscited by 71
  6. 2025DeepScientist: Advancing Frontier-Pushing Scientific Findings Progressivelycited by 63
  7. 2025From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflowscited by 58
  8. 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 57
  9. 2026Agent-World: Scaling Real-World Environment Synthesis for Evolving General Agent Intelligencecited by 54
  10. 2025MiniCPM4: Ultra-Efficient LLMs on End Devicescited by 52
  11. 2025LiveMCPBench: Can Agents Navigate an Ocean of MCP Tools?cited by 48
  12. 2025Earth-Agent: Unlocking the Full Landscape of Earth Observation with Agentscited by 46
38 more
  1. 2025Agentic Web: Weaving the Next Web with AI Agentscited by 45
  2. 2025Enterprise-Grade Security for the Model Context Protocol (MCP): Frameworks and Mitigation Strategiescited by 42
  3. 2025MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agentscited by 42
  4. 2025MCPMark: A Benchmark for Stress-Testing Realistic and Comprehensive MCP Usecited by 39
  5. 2026AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocationscited by 38
  6. 2026Dive into Claude Code: The Design Space of Today's and Future AI Agent Systemscited by 38
  7. 2025ScaleMCP: Dynamic and Auto-Synchronizing Model Context Protocol Tools for LLM Agentscited by 36
  8. 2025MPMA: Preference Manipulation Attack Against Model Context Protocolcited by 34
  9. 2025MCP-SafetyBench: A Benchmark for Safety Evaluation of Large Language Models with Real-World MCP Serverscited by 34
  10. 2025MUA-RL: Multi-turn User-interacting Agent Reinforcement Learning for agentic tool usecited by 32
  11. 2025MCP-AgentBench: Evaluating Real-World Language Agent Performance with MCP-Mediated Toolscited by 32
  12. 2025Internet of Agents: Fundamentals, Applications, and Challengescited by 31
  13. 2025Orak: A Foundational Benchmark for Training and Evaluating LLM Agents on Diverse Video Gamescited by 31
  14. 2026Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystemscited by 31
  15. 2025AgentDistill: Training-Free Agent Distillation with Generalizable MCP Boxescited by 30
  16. 2025Let It Flow: Agentic Crafting on Rock and Roll, Building the ROME Model within an Open Agentic Learning Ecosystemcited by 30
  17. 2025MCP Guardian: A Security-First Layer for Safeguarding MCP-Based AI Systemcited by 28
  18. 2025We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systemscited by 27
  19. 2025Attractive Metadata Attack: Inducing LLM Agents to Invoke Malicious Toolscited by 24
  20. 2025Graphs Meet AI Agents: Taxonomy, Progress, and Future Opportunitiescited by 23
  21. 2025Paper2Agent: Reimagining Research Papers As Interactive and Reliable AI Agentscited by 23
  22. 2025AgentBound: Securing Execution Boundaries of AI Agentscited by 23
  23. 2025AI Scientists Fail Without Strong Implementation Capabilitycited by 21
  24. 2025MCPXKIT: The Unified Toolkit for Analyzing Model Context Protocol Securitycited by 21
  25. 2025Uni-MoE-2.0-Omni: Scaling Language-Centric Omnimodal Large Model with Advanced MoE, Training and Datacited by 21
  26. 2025AI for Service: Proactive Assistance with AI Glassescited by 20
  27. 2025Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystemcited by 19
  28. 2025Automatic Red Teaming LLM-based Agents with Model Context Protocol Toolscited by 18
  29. 2025Security of Internet of Agents: Attacks and Countermeasurescited by 17
  30. 2025LiveMCP-101: Stress Testing and Diagnosing MCP-enabled Agents on Challenging Queriescited by 17
  31. 2025AgentScope 1.0: A Developer-Centric Framework for Building Agentic Applicationscited by 17
  32. 2025Systematization of Knowledge: Security and Safety in the Model Context Protocol Ecosystemcited by 16
  33. 2025We Urgently Need Privilege Management in MCP: A Measurement of API Usage in MCP Ecosystemscited by 15
  34. 2025From Code Foundation Models to Agents and Applications: A Comprehensive Survey and Practical Guide to Code Intelligencecited by 15
  35. 2025A Practical Guide for Designing, Developing, and Deploying Production-Grade Agentic AI Workflowscited by 15
  36. 2026Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANPcited by 15
  37. 2025From Glue-Code to Protocols: A Critical Analysis of A2A and MCP Integration for Scalable Agent Systemscited by 14
  38. 2025A Survey on Agent Workflow -- Status and Futurecited by 14

50 most cited of 265 All 265 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025Securing the Model Context Protocol (MCP): Risks, Controls, and Governance
  2. 2025Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Servers
  3. 2026Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning
  4. 2025When MCP Servers Attack: Taxonomy, Feasibility, and Mitigation
  5. 2025MCPSecBench: A Systematic Security Benchmark and Playground for Testing Model Context Protocols
  6. 2026Compatibility at a Cost: Systematic Discovery and Exploitation of MCP Clause-Compliance Vulnerabilities
  7. 2026SMCP: Secure Model Context Protocol
  8. 2026Rethinking MCP Security: A Large-Scale Study of Runtime MCP Servers and Security Scanner Reliability