mlsanityData to 14 Oct 2026

MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits

arXiv 2504.03767 ↗First posted 2 Apr 2025cs.CR cs.AI cs.LGcited by 63

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

To reduce development overhead and enable seamless integration between potential components comprising any given generative AI application, the Model Context Protocol (MCP) (Anthropic, 2024) has recently been released and subsequently widely adopted. The MCP is an open protocol that standardizes API calls to large language models (LLMs), data sources, and agentic tools. By connecting multiple MCP servers, each defined with a set of tools, resources, and prompts, users are able to define automated workflows fully driven by LLMs. However, we show that the current MCP design carries a wide range of security risks for end users. In particular, we demonstrate that industry-leading LLMs may be coerced into using MCP tools to compromise an AI developer's system through various attacks, such as malicious code execution, remote access control, and credential theft. To proactively mitigate these and related attacks, we introduce a safety auditing tool, MCPSafetyScanner, the first agentic tool to assess the security of an arbitrary MCP server. MCPScanner uses several agents to (a) automatically determine adversarial samples given an MCP server's tools and resources; (b) search for related vulnerabilities and remediations based on those samples; and (c) generate a security report detailing all findings. Our work highlights serious security issues with general-purpose agentic workflows while also providing a proactive tool to audit MCP server safety and address detected vulnerabilities before deployment. The described MCP server auditing tool, MCPSafetyScanner, is freely available at: https://github.com/johnhalloran321/mcpSafetyScanner

Key facts. Cited by 63 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 2 of its 21 references that are in the map. First posted on arXiv 2 Apr 2025.

Builds on

2 of 21 references.

References · 2

  1. 2024The Llama 3 Herd of Modelscited by 14,715
  2. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 24; 2026: 39.

63 papers.

Sort:

By area:

  1. 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 57
  2. 2025MCPSecBench: A Systematic Security Benchmark and Playground for Testing Model Context Protocolscited by 51
  3. 2025MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agentscited by 42
  4. 2025ScaleMCP: Dynamic and Auto-Synchronizing Model Context Protocol Tools for LLM Agentscited by 36
  5. 2025MCP-SafetyBench: A Benchmark for Safety Evaluation of Large Language Models with Real-World MCP Serverscited by 34
  6. 2026The Attack and Defense Landscape of Agentic AI: A Comprehensive Surveycited by 28
  7. 2025We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systemscited by 27
  8. 2026ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injectioncited by 27
  9. 2025AgentBound: Securing Execution Boundaries of AI Agentscited by 23
  10. 2025MCPXKIT: The Unified Toolkit for Analyzing Model Context Protocol Securitycited by 21
  11. 2026How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Studycited by 19
  12. 2026Intelligent AI Delegationcited by 18
38 more
  1. 2025Systematization of Knowledge: Security and Safety in the Model Context Protocol Ecosystemcited by 16
  2. 2026Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANPcited by 15
  3. 2025MCPGuard : Automatically Detecting Vulnerabilities in MCP Serverscited by 14
  4. 2025Semantic Attacks on Tool-Augmented LLMs: Securing the Model Context Protocol Against Descriptor-Level Manipulationcited by 13
  5. 2026Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoningcited by 10
  6. 2025From Standalone LLMs to Integrated Intelligence: A Survey of Compound Al Systemscited by 6
  7. 2025Trivial Trojans: How Minimal MCP Servers Enable Cross-Tool Exfiltration of Sensitive Datacited by 6
  8. 2025Trusted AI Agents in the Cloudcited by 6
  9. 2026ClawHub Security Signals: When VirusTotal, Static Analysis, and SkillSpector Disagreecited by 6
  10. 2026SkillGuard: A Permission-Centric Framework for Agent Skill Securitycited by 6
  11. 2025Communication-Efficient Hybrid Language Model via Uncertainty-Aware Opportunistic and Compressed Transmissioncited by 5
  12. 2025Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessmentcited by 5
  13. 2025Formalizing the Safety, Security, and Functional Properties of Agentic AI Systemscited by 5
  14. 2026SMCP: Secure Model Context Protocolcited by 5
  15. 2026Beyond OAuth: Task-Scoped Authorization for AI Agents via Natural Language Slicescited by 5
  16. 2026Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lenscited by 5
  17. 2026Tracking Capabilities for Safer Agentscited by 4
  18. 2026Architectural Design Decisions in AI Agent Harnessescited by 4
  19. 2025MCP Safety Training: Learning to Refuse Falsely Benign MCP Exploits using Improved Preference Alignmentcited by 3
  20. 2025Help or Hurdle? Rethinking Model Context Protocol-Augmented Large Language Modelscited by 3
  21. 2026MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in Model Context Protocol Agentscited by 3
  22. 2026From Tool Orchestration to Code Execution: A Study of MCP Design Choicescited by 3
  23. 2026Clawed and Dangerous: Can We Trust Open Agentic Systems?cited by 3
  24. 2025A Red Teaming Roadmap Towards System-Level Safetycited by 2
  25. 2025Quantifying Conversation Drift in MCP via Latent Polytopecited by 2
  26. 2026MCP-DPT: A Defense-Placement Taxonomy and Coverage Analysis for Model Context Protocol Securitycited by 2
  27. 2026Skill Description Deception Attack against Task Routing in Internet of Agentscited by 2
  28. 2026ADR: An Agentic Detection System for Enterprise Agentic AI Securitycited by 2
  29. 2026ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCPcited by 2
  30. 2026Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teamingcited by 2
  31. 2026The Path to Self-Evolving Clinical Systems: Scaling Medical Agents from Assistance to Autonomycited by 2
  32. 2026MCP-in-SoS: Risk assessment framework for open-source MCP serverscited by 1
  33. 2026CASCADE: A Component Ablation and Corpus Audit of a Layered Local Defense for MCP-Based Systemscited by 1
  34. 2026LACUNA: Safe Agents as Recursive Program Holescited by 1
  35. 2026TrustedARI: Towards Trust-Native Agentic Routing Infrastructure for Agentic AIcited by 1
  36. 2026Exposed by Design: A Dynamic Security Assessment of Internet-Facing MCP Servers at Scalecited by 1
  37. 2026ToolMinimize: Auditing and Rewriting LLM Agent Tool Calls to Minimize Privacy Exposurecited by 1
  38. 2026CAITLYN: Can LLM Agents Autonomously Synthesize Defenses against Emerging Injection Attacks?cited by 1

50 most cited of 63 All 63 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025Securing the Model Context Protocol (MCP): Risks, Controls, and Governance
  2. 2025Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions
  3. 2025Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem
  4. 2026A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanisms
  5. 2025MCIP: Protecting MCP Safety via Model Contextual Integrity Protocol
  6. 2025MCP Guardian: A Security-First Layer for Safeguarding MCP-Based AI System
  7. 2025A First Look at the Security Issues in the Model Context Protocol Ecosystem
  8. 2025Enterprise-Grade Security for the Model Context Protocol (MCP): Frameworks and Mitigation Strategies