mlsanityData to 14 Oct 2026

ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by using OAuth-Enhanced Tool Definitions and Policy-Based Access Control

arXiv 2506.01333 ↗First posted 2 Jun 2025cs.CR cs.AI cs.ETcited by 20

Not on the map. Why?

Abstract (arXiv)

The Model Context Protocol (MCP) plays a crucial role in extending the capabilities of Large Language Models (LLMs) by enabling integration with external tools and data sources. However, the standard MCP specification presents significant security vulnerabilities, notably Tool Poisoning and Rug Pull attacks. This paper introduces the Enhanced Tool Definition Interface (ETDI), a security extension designed to fortify MCP. ETDI incorporates cryptographic identity verification, immutable versioned tool definitions, and explicit permission management, often leveraging OAuth 2.0. We further propose extending MCP with fine-grained, policy-based access control, where tool capabilities are dynamically evaluated against explicit policies using a dedicated policy engine, considering runtime context beyond static OAuth scopes. This layered approach aims to establish a more secure, trustworthy, and controllable ecosystem for AI applications interacting with LLMs and external tools.

Key facts. Cited by 20 papers in the map (data through 14 Oct 2026). Builds on 7 of its 21 references that are in the map. First posted on arXiv 2 Jun 2025.

Builds on

7 of 21 references.

References · 7

  1. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 364
  2. 2025Enterprise-Grade Security for the Model Context Protocol (MCP): Frameworks and Mitigation Strategiescited by 42
  3. 2025Securing Agentic AI: A Comprehensive Threat Model and Mitigation Framework for Generative AI Agentscited by 32
  4. 2025Securing GenAI Multi-Agent Systems Against Tool Squatting: A Zero Trust Registry-Based Approachcited by 18
  5. 2025System Prompt Poisoning: Persistent Attacks on Large Language Models Beyond User Injectioncited by 14
  6. 2016A Comprehensive Formal Security Analysis of OAuth 2.0cited by 4
  7. 2024How We Built Cedar: A Verification-Guided Approachcited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 5; 2026: 15.

20 papers.

Sort:

By area:

  1. 2025MCPSecBench: A Systematic Security Benchmark and Playground for Testing Model Context Protocolscited by 51
  2. 2026AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocationscited by 38
  3. 2025Systematization of Knowledge: Security and Safety in the Model Context Protocol Ecosystemcited by 16
  4. 2026Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANPcited by 15
  5. 2025MCPGuard : Automatically Detecting Vulnerabilities in MCP Serverscited by 14
  6. 2025Semantic Attacks on Tool-Augmented LLMs: Securing the Model Context Protocol Against Descriptor-Level Manipulationcited by 13
  7. 2026Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoningcited by 10
  8. 2026MCP-38: A Comprehensive Threat Taxonomy for Model Context Protocol Systems (v1.0)cited by 6
  9. 2025Agent Capability Negotiation and Binding Protocol (ACNBP)cited by 4
  10. 2026A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanismscited by 3
  11. 2026TrustedARI: Towards Trust-Native Agentic Routing Infrastructure for Agentic AIcited by 1
  12. 2026Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol: An Approval-View Fidelity Gap Across Three Independent Server Implementationscited by 0
8 more
  1. 2026From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructurecited by 0
  2. 2026When Agents Act on Web3: An Attack-Surface Survey of MCP, Skills, and Tool Callingcited by 0
  3. 2026AEGIS: Preventing Cross-Domain Resource Abuse in MCPcited by 0
  4. 2026ECLIPSE: Self-Evolving Stealthy Prompt Injection Attack against Long-Horizon Agentic Systemscited by 0
  5. 2026Reputation as Community Memory for the Agentic Webcited by 0
  6. 2026Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open Challengescited by 0
  7. 2026When Valid Tool Calls Change Meaning: Formation-Consistent Dispatch for LLM Agentscited by 0
  8. 2026Securing Computer-Use Agents Against Branch Steering Attackscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Attested Tool-Server Admission: A Security Extension to the Model Context Protocol
  2. 2025MCPXKIT: The Unified Toolkit for Analyzing Model Context Protocol Security
  3. 2025MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agents
  4. 2025Parasites in the Toolchain: A Large-Scale Analysis of Attacks on the MCP Ecosystem
  5. 2025A First Look at the Security Issues in the Model Context Protocol Ecosystem
  6. 2026Give Them an Inch and They Will Take a Mile:Understanding and Measuring Caller Identity Confusion in MCP-Based AI Systems
  7. 2025Securing the Model Context Protocol (MCP): Risks, Controls, and Governance
  8. 2025Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem