mlsanityData to 14 Oct 2026

MCIP: Protecting MCP Safety via Model Contextual Integrity Protocol

arXiv 2505.14590 ↗First posted 20 May 2025cs.CLcited by 34

Not on the map. Why?

Cited by 29 in LLM agents and tool use, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

As Model Context Protocol (MCP) introduces an easy-to-use ecosystem for users and developers, it also brings underexplored safety risks. Its decentralized architecture, which separates clients and servers, poses unique challenges for systematic safety analysis. This paper proposes a novel framework to enhance MCP safety. Guided by the MAESTRO framework, we first analyze the missing safety mechanisms in MCP, and based on this analysis, we propose the Model Contextual Integrity Protocol (MCIP), a refined version of MCP that addresses these gaps. Next, we develop a fine-grained taxonomy that captures a diverse range of unsafe behaviors observed in MCP scenarios. Building on this taxonomy, we develop benchmark and training data that support the evaluation and improvement of LLMs' capabilities in identifying safety risks within MCP interactions. Leveraging the proposed benchmark and training data, we conduct extensive experiments on state-of-the-art LLMs. The results highlight LLMs' vulnerabilities in MCP interactions and demonstrate that our approach substantially improves their safety performance.

Key facts. Cited by 34 papers in the map (data through 14 Oct 2026). Builds on 27 of its 45 references that are in the map. First posted on arXiv 20 May 2025.

Builds on

27 of 45 references.

References · 27

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2022Training language models to follow instructions with human feedbackcited by 15,971
  3. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  4. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
  5. 2023A Survey on Large Language Model based Autonomous Agentscited by 2,242
  6. 2023The Rise and Potential of Large Language Model Based Agents: A Surveycited by 1,439
  7. 2022Red Teaming Language Models with Language Modelscited by 1,026
  8. 2023Unifying Large Language Models and Knowledge Graphs: A Roadmapcited by 668
  9. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 573
  10. 2023Identifying the Risks of LM Agents with an LM-Emulated Sandboxcited by 548
  11. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agentscited by 369
  12. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 333
15 more
  1. 2025AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agentscited by 223
  2. 2021Internet-Augmented Dialogue Generationcited by 217
  3. 2023Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injectioncited by 157
  4. 2023Solving Math Word Problems by Combining Language Models With Symbolic Solverscited by 124
  5. 2023Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Modelscited by 94
  6. 2023AgentSims: An Open-Source Sandbox for Large Language Model Evaluationcited by 88
  7. 2023Sentence Embedding Leaks More Information than You Expect: Generative Embedding Inversion Attack to Recover the Whole Sentencecited by 81
  8. 2024TrustAgent: Towards Safe and Trustworthy LLM-based Agentscited by 64
  9. 2025Can Indirect Prompt Injection Attacks Be Detected and Removed?cited by 52
  10. 2023ChatGPT Evaluation on Sentence Level Relations: A Focus on Temporal, Causal, and Discourse Relationscited by 40
  11. 2024GoldCoin: Grounding Large Language Models in Privacy Laws via Contextual Integrity Theorycited by 37
  12. 2025PrivaCI-Bench: Evaluating Privacy with Contextual Integrity and Legal Compliancecited by 37
  13. 2024Privacy Checklist: Privacy Violation Detection Grounding on Contextual Integrity Theorycited by 18
  14. 2023Attacking by Aligning: Clean-Label Backdoor Attacks on Object Detectioncited by 11
  15. 2024BaThe: Defense against the Jailbreak Attack in Multimodal Large Language Models by Treating Harmful Instruction as Backdoor Triggercited by 8

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 14; 2026: 20.

34 papers.

Sort:

By area:

  1. 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 57
  2. 2025MCPSecBench: A Systematic Security Benchmark and Playground for Testing Model Context Protocolscited by 51
  3. 2025MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agentscited by 42
  4. 2025MCP-SafetyBench: A Benchmark for Safety Evaluation of Large Language Models with Real-World MCP Serverscited by 34
  5. 2025AgentDistill: Training-Free Agent Distillation with Generalizable MCP Boxescited by 30
  6. 2026The Attack and Defense Landscape of Agentic AI: A Comprehensive Surveycited by 28
  7. 2025AgentBound: Securing Execution Boundaries of AI Agentscited by 23
  8. 2025MCP-Guard: A Multi-Stage Defense-in-Depth Framework for Securing Model Context Protocol in Agentic AIcited by 19
  9. 2025RAS-Eval: A Comprehensive Benchmark for Security Evaluation of LLM Agents in Real-World Environmentscited by 17
  10. 2026VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commitcited by 17
  11. 2025SoK: Trust-Authorization Mismatch in LLM Agent Interactionscited by 11
  12. 2025MindGuard: Intrinsic Decision Inspection for Securing LLM Agents Against Metadata Poisoningcited by 10
22 more
  1. 2025Alita-G: Self-Evolving Generative Agent for Agent Generationcited by 10
  2. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluationcited by 7
  3. 2025Trusted AI Agents in the Cloudcited by 6
  4. 2026MCP-38: A Comprehensive Threat Taxonomy for Model Context Protocol Systems (v1.0)cited by 6
  5. 2026SMCP: Secure Model Context Protocolcited by 5
  6. 2026Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planningcited by 3
  7. 2025Safety Compliance: Rethinking LLM Safety Reasoning through the Lens of Compliancecited by 2
  8. 2026MCP-DPT: A Defense-Placement Taxonomy and Coverage Analysis for Model Context Protocol Securitycited by 2
  9. 2026ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCPcited by 2
  10. 2025Can LLM Infer Risk Information From MCP Server System Logs?cited by 1
  11. 2026OmniCompliance-100K: A Multi-Domain, Rule-Grounded, Real-World Safety Compliance Datasetcited by 1
  12. 2026It Takes Two: Complementary Self-Distillation for Contextual Integrity in LLMscited by 1
  13. 2026TrustedARI: Towards Trust-Native Agentic Routing Infrastructure for Agentic AIcited by 1
  14. 2026Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directionscited by 1
  15. 2026What Guides the Agent? Adjudicating Unauthorized Behavior via Localizing Behavior-Guiding Instructionscited by 1
  16. 2026Hybrid Analysis for Secure MCP Tool Use in LLM Agentscited by 0
  17. 2026Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecturecited by 0
  18. 2026AEGIS: Preventing Cross-Domain Resource Abuse in MCPcited by 0
  19. 2026TrustShiftProbe: Characterizing, Benchmarking, and Defending Staged Trust Attacks on MCP Serverscited by 0
  20. 2026WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agentscited by 0
  21. 2026PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agentscited by 0
  22. 2026TRAP: Tool-result Replay Attack for Probing Misbinding in LLM Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions
  2. 2025MCPGuard : Automatically Detecting Vulnerabilities in MCP Servers
  3. 2025MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits
  4. 2026Unsafe by Flow: Uncovering Bidirectional Data-Flow Risks in MCP Ecosystem
  5. 2025A First Look at the Security Issues in the Model Context Protocol Ecosystem
  6. 2025We Urgently Need Privilege Management in MCP: A Measurement of API Usage in MCP Ecosystems
  7. 2026MCP-in-SoS: Risk assessment framework for open-source MCP servers
  8. 2026Breaking the Protocol: Security Analysis of the Model Context Protocol Specification and Prompt Injection Vulnerabilities in Tool-Integrated LLM Agents