mlsanityData to 14 Oct 2026

AegisMCP: Online Graph Intrusion Detection for Tool-Augmented LLMs on Edge Devices

arXiv 2510.19462 ↗First posted 22 Oct 2025cs.CRcited by 2

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

In this work, we study security of Model Context Protocol (MCP) agent toolchains and their applications in smart homes. We introduce AegisMCP, a protocol-level intrusion detector. Our contributions are: (i) a minimal attack suite spanning instruction-driven escalation, chain-of-tool exfiltration, malicious MCP server registration, and persistence; (ii) NEBULA-Schema (Network-Edge Behavioral Learning for Untrusted LLM Agents), a reusable protocol-level instrumentation that represents MCP activity as a streaming heterogeneous temporal graph over agents, MCP servers, tools, devices, remotes, and sessions; and (iii) a CPU-only streaming detector that fuses novelty, session-DAG structure, and attribute cues for near-real-time edge inference, with optional fusion of local prompt-guardrail signals. On an emulated smart-home testbed spanning multiple MCP stacks and a physical bench, AegisMCP achieves sub-second per-window model inference and end-to-end alerting. The latency of AegisMCP is consistently sub-second on Intel N150-class edge hardware, while outperforming traffic-only and sequence baselines; ablations confirm the importance of DAG and install/permission signals. We release code, schemas, and generators for reproducible evaluation.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 20 of its 51 references that are in the map. First posted on arXiv 22 Oct 2025.

Builds on

20 of 51 references.

Closest ancestors · 1

Same direction, newest first

  1. 2025SentinelAgent: Graph-based Anomaly Detection in Multi-Agent Systems30 May

Other references · 19

  1. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
  2. 2017Inductive Representation Learning on Large Graphscited by 6,320
  3. 2016XGBoost: A Scalable Tree Boosting Systemcited by 5,166
  4. 2014Learning Phrase Representations using RNN Encoder-Decoder for Statistical Machine Translationcited by 4,057
  5. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 3,050
  6. 2019Fast Graph Representation Learning with PyTorch Geometriccited by 2,434
  7. 2017Modeling Relational Data with Graph Convolutional Networkscited by 1,694
  8. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  9. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  10. 2020Temporal Graph Networks for Deep Learning on Dynamic Graphscited by 530
  11. 2020Inductive Representation Learning on Temporal Graphscited by 462
  12. 2018Adversarial Attacks on Neural Networks for Graph Datacited by 397
7 more
  1. 2018Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detectioncited by 121
  2. 2018Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Datasetcited by 99
  3. 2024Attention Tracker: Detecting Prompt Injection Attacks in LLMscited by 95
  4. 2018N-BaIoT: Network-based Detection of IoT Botnet Attacks Using Deep Autoencoderscited by 67
  5. 2018HOLMES: Real-time APT Detection through Correlation of Suspicious Information Flowscited by 43
  6. 2024Embedding-based classifiers can detect prompt injection attackscited by 27
  7. 2024Palisade -- Prompt Injection Detection Frameworkcited by 5

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Device Context Protocol: A Compact, Safety-First Architecture for LLM-Driven Control of Constrained Devicescited by 0
  2. 2026From Acoustic Sensing to Physical Actions: A Comprehensive Survey of Security Risks in Edge-Deployed Audio LLM-Based Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Content-Aware Attack Detection in LLM Agent Tool-Call Traffic: An Empirical Study of Features, Architectures, and Evaluation Protocols
  2. 2025MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agents
  3. 2026MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCP
  4. 2026Breaking the Protocol: Security Analysis of the Model Context Protocol Specification and Prompt Injection Vulnerabilities in Tool-Integrated LLM Agents
  5. 2025MCPXKIT: The Unified Toolkit for Analyzing Model Context Protocol Security
  6. 2026PropGuard: Safeguarding LLM-MAS via Propagation-Aware Exploration and Remediation
  7. 2025MindGuard: Intrinsic Decision Inspection for Securing LLM Agents Against Metadata Poisoning
  8. 2025MCPSecBench: A Systematic Security Benchmark and Playground for Testing Model Context Protocols