# MCP Guardian: A Security-First Layer for Safeguarding MCP-Based AI System

arXiv: https://arxiv.org/abs/2504.12757 · HTML: https://mlsanity.com/paper/2504.12757/

## Key facts

- Cited by 28 papers in the map (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 1 of its 10 references that are in the map.
- First posted on arXiv 17 Apr 2025.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 1 of 1)

- [Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions](https://mlsanity.com/paper/2503.23278/) (2025)

## Built on by (most cited first, 28 of 28)

- [A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures](https://mlsanity.com/paper/2506.19676/) (2025)
- [MCPSecBench: A Systematic Security Benchmark and Playground for Testing Model Context Protocols](https://mlsanity.com/paper/2508.13220/) (2025)
- [We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems](https://mlsanity.com/paper/2506.13666/) (2025)
- [AgentBound: Securing Execution Boundaries of AI Agents](https://mlsanity.com/paper/2510.21236/) (2025)
- [MCPXKIT: The Unified Toolkit for Analyzing Model Context Protocol Security](https://mlsanity.com/paper/2508.12538/) (2025)
- [Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem](https://mlsanity.com/paper/2506.02040/) (2025)
- [MCP-Guard: A Multi-Stage Defense-in-Depth Framework for Securing Model Context Protocol in Agentic AI](https://mlsanity.com/paper/2508.10991/) (2025)
- [We Urgently Need Privilege Management in MCP: A Measurement of API Usage in MCP Ecosystems](https://mlsanity.com/paper/2507.06250/) (2025)
- [MCPGuard : Automatically Detecting Vulnerabilities in MCP Servers](https://mlsanity.com/paper/2510.23673/) (2025)
- [AgentMaster: A Multi-Agent Conversational Framework Using A2A and MCP Protocols for Multimodal Information Retrieval and Analysis](https://mlsanity.com/paper/2507.21105/) (2025)
- [Alita-G: Self-Evolving Generative Agent for Agent Generation](https://mlsanity.com/paper/2510.23601/) (2025)
- [Beyond Data Privacy: New Privacy Risks for Large Language Models](https://mlsanity.com/paper/2509.14278/) (2025)
- [Takedown: How It's Done in Modern Coding Agent Exploits](https://mlsanity.com/paper/2509.24240/) (2025)
- [MCP Safety Training: Learning to Refuse Falsely Benign MCP Exploits using Improved Preference Alignment](https://mlsanity.com/paper/2505.23634/) (2025)
- [MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in Model Context Protocol Agents](https://mlsanity.com/paper/2602.14281/) (2026)
- [Invisible Threats from Model Context Protocol: Generating Stealthy Injection Payload via Tree-based Adaptive Search](https://mlsanity.com/paper/2603.24203/) (2026)
- [ADR: An Agentic Detection System for Enterprise Agentic AI Security](https://mlsanity.com/paper/2605.17380/) (2026)
- [ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP](https://mlsanity.com/paper/2606.27027/) (2026)
- [From Secure Agentic AI to Secure Agentic Web: Challenges, Threats, and Future Directions](https://mlsanity.com/paper/2603.01564/) (2026)
- [MCP-in-SoS: Risk assessment framework for open-source MCP servers](https://mlsanity.com/paper/2603.10194/) (2026)
- [CASCADE: A Component Ablation and Corpus Audit of a Layered Local Defense for MCP-Based Systems](https://mlsanity.com/paper/2604.17125/) (2026)
- [TrustedARI: Towards Trust-Native Agentic Routing Infrastructure for Agentic AI](https://mlsanity.com/paper/2606.15822/) (2026)
- [ColorEcosystem: Powering Personalized, Standardized, and Trustworthy Agentic Service in massive-agent Ecosystem](https://mlsanity.com/paper/2510.21566/) (2025)
- [Training-Free Refusal of MCP Exploits via Retrieval-Augmented Generation](https://mlsanity.com/paper/2605.11217/) (2026)
- [Agent System Operations: Categorization, Challenges, and Future Directions](https://mlsanity.com/paper/2606.01581/) (2026)
- [When Agents Act on Web3: An Attack-Surface Survey of MCP, Skills, and Tool Calling](https://mlsanity.com/paper/2608.17275/) (2026)
- [AEGIS: Preventing Cross-Domain Resource Abuse in MCP](https://mlsanity.com/paper/2608.20481/) (2026)
- [TrustShiftProbe: Characterizing, Benchmarking, and Defending Staged Trust Attacks on MCP Servers](https://mlsanity.com/paper/2608.23763/) (2026)

## Abstract (arXiv)

As Agentic AI gain mainstream adoption, the industry invests heavily in model capabilities, achieving rapid leaps in reasoning and quality. However, these systems remain largely confined to data silos, and each new integration requires custom logic that is difficult to scale. The Model Context Protocol (MCP) addresses this challenge by defining a universal, open standard for securely connecting AI-based applications (MCP clients) to data sources (MCP servers). However, the flexibility of the MCP introduces new risks, including malicious tool servers and compromised data integrity. We present MCP Guardian, a framework that strengthens MCP-based communication with authentication, rate-limiting, logging, tracing, and Web Application Firewall (WAF) scanning. Through real-world scenarios and empirical testing, we demonstrate how MCP Guardian effectively mitigates attacks and ensures robust oversight with minimal overheads. Our approach fosters secure, scalable data access for AI assistants, underscoring the importance of a defense-in-depth approach that enables safer and more transparent innovation in AI-driven environments.